Certificates

Authentication to alien is done via certificates. To obtain a certificate, PANDA callaborators should contact their local Certification Authority (CA).

Procedure:

1. Read attentively all explanations on this wiki
2. Install alien on your computer
3. Navigate to your local CA's site (see list below) and follow the instructions

Certificate subject

To authenticate, your certificate subject has to match the one allocated in LDAP to your alien user or host. After obtaining a new certificate, you have to communicate the certificate subject to the Grid Admin. The subject looks something like this:

/C=ch/O=AliEn/OU=PANDA/CN=John Smith

To double-check, see what is printed on the screen after you type alien proxy-init once you installed you new certificates.

Types

There are two types of certificates that we use with PANDA Grid:

Site (machine) certificates

Site certificates are machine certificates with subject like .../CN=gridpc1.gsi.de, and empty passphrase, used to identify a site headnode. These are applied for and used by site admins only.
If you are only installing an alien client, you don't need a site certificate but a user certificate.

User certificates

User certificates identify an individual user to the Grid. They would have subject lines like .../CN=John Smith and be protected by a passphrase. If you have exported your certificate from the browser, in p12 format, use these command to convert it:

openssl pkcs12 -in export.p12 -clcerts -nokeys -out $HOME/.globus/usercert.pem
openssl pkcs12 -in export.p12 -nocerts -out $HOME/.globus/userkey.pem

The user certificate can safely be world readable, but userkey.pem must be readable by you only !

chmod 0400 $HOME/.globus/userkey.pem

Other

Certificates from other Certification Authorities than the ones listed below can in principle be used. Please contact the Grid Admin for this.

Certification Authorities

Here is a list of CAs:

• UK: National Grid Service NGS
• Netherlands: DutchGrid CA
• Germany: GermanGrid CA You could also contact Kilian Schwarz for help.
• Austria: AustrianGrid CA
• Italy: INFN CA
• Romania: RomanianGrid CA
• Russia: RDIG CA
• Philippines: EUAsiaGrid CA
• France: French CA

Please navigate to your local CA's site and follow the instructions therein. If your country's CA is not in here, please notify us to add it.
to top