Difference between revisions of "Preparing a client certificate"
(→Uploading and conversion of the .p12 for your target machine) |
|||
| Line 7: | Line 7: | ||
As the authentication methods for clusters differ, this section will defer to documentations for your particular site when it comes to transferring files to and from the cluster storage. | As the authentication methods for clusters differ, this section will defer to documentations for your particular site when it comes to transferring files to and from the cluster storage. | ||
| − | The goal is to end up with a <tt>.globus</tt> directory in your home directory, containing two files named <tt>usercert.pem</tt> and <tt>userkey.pem</tt>. | + | The goal is to end up with a <tt>.globus</tt> directory in your home directory, containing two files named <tt>usercert.pem</tt> and <tt>userkey.pem</tt>. The instructions below assume that your exported certificate file is named <tt>export.p12</tt> directly in your home directory. If it's a <tt>.pfx</tt> or with a different name, adjust accordingly. |
| − | * Transfer the <tt>.p12</tt> file to your home directory on the cluster. | + | * Transfer the <tt>export.p12</tt> file to your home directory on the cluster. |
* Get an interactive shell on the login node, via ssh. | * Get an interactive shell on the login node, via ssh. | ||
* If an .globus directory already exists, rename it with something like | * If an .globus directory already exists, rename it with something like | ||
| Line 15: | Line 15: | ||
* Create the directory with | * Create the directory with | ||
<tt>mkdir ~/.globus</tt> | <tt>mkdir ~/.globus</tt> | ||
| − | * | + | * Extract and protect the private key part of <tt>export.p12</tt>: |
| − | + | ``openssl pkcs12 -nocerts -in ~/export.p12 -out ~/.globus/userkey.pem`` | |
| − | + | * When asked for import password, specify the password specified when exporting the certificate bundle from your browser. The PEM pass phrase should be a new password that you need to provide whenever using the certificate for tasks like generating a proxy certificate. The output from this command will be similar to the following: | |
| + | Enter Import Password: ******* | ||
| + | MAC verified OK | ||
| + | Enter PEM pass phrase: ******* | ||
| + | Verifying - Enter PEM pass phrase: ******* | ||
| − | + | * Extract the public client certificate part of <tt>export.p12</tt>: | |
| + | openssl pkcs12 -clcerts -nokeys -in ~/export.p12 -out ~/globus/usercert.pem | ||
| + | * The output will be similar to the following: | ||
| + | Enter Import Password: ******* | ||
| + | MAC verified OK | ||
| + | * Finally ensure that only your user is allowed to read the private key file. This is important, both for security and due to some tools refusing to use private keys with insufficient restrictions. | ||
chmod 0400 ~/.globus/userkey.pem | chmod 0400 ~/.globus/userkey.pem | ||
Revision as of 11:35, 18 April 2013
Most of the standalone third party tools installed on SNIC resources and your own machine will not be able to use a .p12 certificate bundle (or .pfx if you exported from IE), as that format is intended primarily for secure transport and backup of certificates and their private keys.
Instead of a single .p12 file, they expect a pair of files in .pem format, one containing the certificate and the other containing the private key that matches the certificate.
Uploading and conversion of the .p12 for your target machine
As the authentication methods for clusters differ, this section will defer to documentations for your particular site when it comes to transferring files to and from the cluster storage.
The goal is to end up with a .globus directory in your home directory, containing two files named usercert.pem and userkey.pem. The instructions below assume that your exported certificate file is named export.p12 directly in your home directory. If it's a .pfx or with a different name, adjust accordingly.
- Transfer the export.p12 file to your home directory on the cluster.
- Get an interactive shell on the login node, via ssh.
- If an .globus directory already exists, rename it with something like
mv ~/.globus ~/.globus-old
- Create the directory with
mkdir ~/.globus
- Extract and protect the private key part of export.p12:
``openssl pkcs12 -nocerts -in ~/export.p12 -out ~/.globus/userkey.pem``
- When asked for import password, specify the password specified when exporting the certificate bundle from your browser. The PEM pass phrase should be a new password that you need to provide whenever using the certificate for tasks like generating a proxy certificate. The output from this command will be similar to the following:
Enter Import Password: ******* MAC verified OK Enter PEM pass phrase: ******* Verifying - Enter PEM pass phrase: *******
- Extract the public client certificate part of export.p12:
openssl pkcs12 -clcerts -nokeys -in ~/export.p12 -out ~/globus/usercert.pem
- The output will be similar to the following:
Enter Import Password: ******* MAC verified OK
- Finally ensure that only your user is allowed to read the private key file. This is important, both for security and due to some tools refusing to use private keys with insufficient restrictions.
chmod 0400 ~/.globus/userkey.pem
