In this next section we create a certificate authority. Note that it is only necessary to create a certificate authority on one machine in your 'grid'. For the purposes of this tutorial we will use nodeB, though any of the Globus installations could be used, including a host that is not directly part of your grid.

If you have not already setup your environment for the globus user do that now:

export GLOBUS_LOCATION=/opt/globus-4.0.1
source $GLOBUS_LOCATION/etc/globus-user-env.sh

Now run the 'setup-simple-ca' command to begin the setup process. This is a short, menu driven script so the input needed to be typed in is shown in red:

Note that you will be prompted twice for a password or pass phrase. Please be sure to remember this pass phrase.

[globus@nodeB gt4.0.1-all-source-installer]$ $GLOBUS_LOCATION/setup/globus/setup-simple-ca

WARNING: GPT_LOCATION not set, assuming:
GPT_LOCATION=/opt/globus-4.0.1

C e r t i f i c a t e A u t h o r i t y S e t u p

This script will setup a Certificate Authority for signing Globus users certificates. It will also generate a simple CA package that can be distributed to the users of the CA.

The CA information about the certificates it distributes will be kept in:

/home/globus/.globus/simpleCA/

The unique subject name for this CA is:

cn=Globus Simple CA, ou=simpleCA-nodeb.ps.univa.com, ou=GlobusTest, o=Grid

Do you want to keep this as the CA subject (y/n) [y]:

Enter a unique subject name for this CA:

cn=<MyOrganization>,ou=ConsortiumTutorial,ou=GlobusTest,o=Grid

Replace <MyOrganization> with the name of your organization.

Enter the email of the CA (this is the email where certificate requests will be sent to be signed by the CA):

Replace <MyEmailAddress> with your e-mail address, or simply a dummy e-mail address as this is not important.

The CA certificate has an expiration date. Keep in mind that once the CA certificate has expired, all the certificates signed by that CA become invalid. A CA should regenerate the CA certificate and start re-issuing ca-setup packages before the actual CA certificate expires. This can be done by re-running this setup script. Enter the number of DAYS the CA certificate should last before it expires.
[default: 5 years (1825 days)]:

Hit Return to accept default.

Enter PEM pass phrase:<MyPEMpassPhrase>
Verifying - Enter PEM pass phrase:<MyPEMpassPhrase>

Replace <MyPEMpassPhrase> with your choice of PEM pass phrase, the pass phrase "GlobusTutorial" (whithout the quotes) was used in the compilation of this tutorial.

creating CA config package...done.

A self-signed certificate has been generated
for the Certificate Authority with the subject:

/O=Grid/OU=GlobusTest/OU=ConsortiumTutorial/CN=<MyOrganization>

If this is invalid, rerun this script

/opt/globus-4.0.1/setup/globus/setup-simple-ca

and enter the appropriate fields.

-------------------------------------------------------------------

The private key of the CA is stored in /home/globus/.globus/simpleCA//private/cakey.pem
The public CA certificate is stored in /home/globus/.globus/simpleCA//cacert.pem

The distribution package built for this CA is stored in

/home/globus/.globus/simpleCA//globus_simple_ca_768c46a5_setup-0.19.tar.gz

This file must be distributed to any host wishing to request
certificates from this CA.

CA setup complete.

The following commands will now be run to setup the security
configuration files for this CA:

$GLOBUS_LOCATION/sbin/gpt-build /home/globus/.globus/simpleCA//globus_simple_ca_768c46a5_setup-0.19.tar.gz

$GLOBUS_LOCATION/sbin/gpt-postinstall
-------------------------------------------------------------------

setup-ssl-utils: Configuring ssl-utils package
Running setup-ssl-utils-sh-scripts...

Note: To complete setup of the GSI software you need to run the following script as root to configure your security configuration directory:

/opt/globus-4.0.1/setup/globus_simple_ca_f1f2d5e6_setup/setup-gsi

For further information on using the setup-gsi script, use the -help option. The -default option sets this security configuration to be the default, and -nonroot can be used on systems where root access is not available.

setup-ssl-utils: Complete

In the output above you may see that a unique hash number for the CA was created. In your example the hash number will be different since your organization name will be different.

As indicated by the output above, we next need to run the 'setup-gsi' command. We will run it with the '-default' flag so that the CA we just created becomes the default certificate authority for certificates created on this node. We also use the '-nonroot' flag in order to keep all the configuration under the directory $GLOBUS_DIRECTION. This does not have to be run as root as the output from the setup-simple-ca command entered above would have you indicate.

[globus@nodeB ~]$ /opt/globus-4.0.1/setup/globus_simple_ca_f1f2d5e6_setup/setup-gsi -default -nonroot
setup-gsi: Configuring GSI security
Making trusted certs directory: /opt/globus-4.0.1/share/certificates/
mkdir /opt/globus-4.0.1/share/certificates/
Installing /opt/globus-4.0.1/share/certificates//grid-security.conf.f1f2d5e6...
Running grid-security-config...
Installing Globus CA certificate into trusted CA certificate directory...
Installing Globus CA signing policy into trusted CA certificate directory...
setup-gsi: Complete

Now the CA just created is installed and is the default for requesting certificates on nodeB.

< Back Next >