This script prompts you for information about the CA you wish to create:

The unique subject name for this CA is:
cn=Globus Simple CA, ou=simpleCA-grid.example.org, ou=GlobusTest, o=Grid

Do you want to keep this as the CA subject (y/n) [y]:

where:

Press y to keep the default subject name (recommended).

The next prompt looks like:

Enter the email of the CA (this is the email where certificate
requests will be sent to be signed by the CA):

Enter the email address where you intend to receive certificate requests. It should be your real email address that you check, not the address of the globus user.

Then you'll see:

The CA certificate has an expiration date. Keep in mind that 
once the CA certificate has expired, all the certificates 
signed by that CA become invalid.  A CA should regenerate 
the CA certificate and start re-issuing ca-setup packages 
before the actual CA certificate expires.  This can be done 
by re-running this setup script.  Enter the number of DAYS 
the CA certificate should last before it expires.
[default: 5 years (1825 days)]:

This is the number of days for which the CA certificate is valid. Once this time expires, the CA certificate will have to be recreated and all of its certificates regranted.

Accept the default (recommended).

Next you'll see:

Generating a 1024 bit RSA private key
........++++++
................++++++
writing new private key to '/home/globus/.globus/simpleCA//private/cakey.pem'
Enter PEM pass phrase:

The passphrase of the CA certificate will be used only when signing certificates (with grid-cert-sign). It should be hard to guess, as its compromise will compromise all the certificates signed by the CA.

Enter your passphrase.

	Important:
	Your passphrase must not contain any spaces.

Finally you'll see the following:

A self-signed certificate has been generated 
for the Certificate Authority with the subject: 

/O=Grid/OU=GlobusTest/OU=simpleCA-grid.example.org/CN=Globus Simple CA
                
If this is invalid, rerun this script 
                
setup/globus/setup-simple-ca
                
and enter the appropriate fields.

-------------------------------------------------------------------
                
The private key of the CA is stored in /home/globus/.globus/simpleCA//private/cak ey.pem
The public CA certificate is stored in /home/globus/.globus/simpleCA//cacert.pem
                
The distribution package built for this CA is stored in
                
/home/globus/.globus/simpleCA//globus_simple_ca_68ea3306_setup-0.17.tar.gz

This information will be important for setting up other machines in your grid. The number 68ea3306 in the last line is known as your CA hash. It will be an 8 hexadecimal digit string.

Press any key to acknowledge this screen.

Your CA setup package finishes installing and ends the procedure with the following reminder:

***************************************************************************

Note: To complete setup of the GSI software you need to run the
following script as root to configure your security configuration
directory:

/opt/gt4/setup/globus_simple_ca_68ea3306_setup/setup-gsi

For further information on using the setup-gsi script, use the -help
option.  The -default option sets this security configuration to be 
the default, and -nonroot can be used on systems where root access is 
not available.

***************************************************************************
                
setup-ssl-utils: Complete

We'll run the setup-gsi script in the next section. For now, just notice that it refers to your $GLOBUS_LOCATION and the CA Hash from the last message.

To finish the setup of GSI, we'll run the script noted in the previous step.

Run the following as root (or, if no root privileges are available, add the -nonroot option to the command line):

$GLOBUS_LOCATION/setup/globus_simple_ca_CA_Hash_setup/setup-gsi -default

The output should look like:

setup-gsi: Configuring GSI security
Installing /etc/grid-security/certificates//grid-security.conf.CA_Hash...
Running grid-security-config...
Installing Globus CA certificate into trusted CA certificate directory...
Installing Globus CA signing policy into trusted CA certificate directory...
setup-gsi: Complete

As root, run:

grid-cert-request -host 'hostname'

This creates the following files:

Note: If you are using your own CA, follow their instructions about creating a hostcert (one which has a commonName (CN) of your hostname), then place the cert and key in the /etc/grid-security/ location. You may then proceed to Section 4, “User certificates”.

The certificate should be owned by root and be read-only for other users.

The key should be read-only by root.

As your normal user account (not globus), run:

% grid-cert-request

A private key and a certificate request has been generated
with the subject:

/O=Grid/OU=GlobusTest/OU=simpleCA-grid.example.org/CN=Joe User

----------------------------------------------------------

The private key is stored in /home/juser/.globus/hostkey.pem
The request is stored in /home/juser/.globus/hostcert_request.pem

Please e-mail the request to the Example CA grid@example.org
You may use a command similar to the following:

 cat /tmp/example/hostcert_request.pem | mail grid@example.org

Only use the above if this machine can send AND receive e-mail. if not, please
mail using some other method.

Your certificate will be mailed to you within two working days.
If you receive no response, contact Example CA at grid@example.org


            

After you enter a passphrase, this creates

Email the usercert_request.pem file to the CA administrator maintainer.

The certificate should be owned by the user and be read-only for other users.

The key must be read-only by the owner.