1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247
|
'\" t
.\" Title: grid-ca-create
.\" Author: [see the "AUTHOR" section]
.\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
.\" Date: 03/31/2018
.\" Manual: Grid Community Toolkit Manual
.\" Source: Grid Community Toolkit 6
.\" Language: English
.\"
.TH "GRID\-CA\-CREATE" "1" "03/31/2018" "Grid Community Toolkit 6" "Grid Community Toolkit Manual"
.\" -----------------------------------------------------------------
.\" * Define some portability stuff
.\" -----------------------------------------------------------------
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.\" http://bugs.debian.org/507673
.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.ie \n(.g .ds Aq \(aq
.el .ds Aq '
.\" -----------------------------------------------------------------
.\" * set default formatting
.\" -----------------------------------------------------------------
.\" disable hyphenation
.nh
.\" disable justification (adjust text to left margin only)
.ad l
.\" -----------------------------------------------------------------
.\" * MAIN CONTENT STARTS HERE *
.\" -----------------------------------------------------------------
.SH "NAME"
grid-ca-create \- Create a CA to sign certificates for use on a grid
.SH "SYNOPSIS"
.sp
\fBgrid\-ca\-create\fR [ \-h | \-help | \-usage | \-version | \-versions ] [ \-openssl\-help]
.sp
\fBgrid\-ca\-create\fR [ OPTIONS ] [ OPENSSL\-OPTIONS ]
.SH "DESCRIPTION"
.sp
The \fBgrid\-ca\-create\fR program creates a self\-signed CA certificate and related files needed to use the CA with other Globus tools\&. The \fBgrid\-ca\-create\fR program prompts for information to use to generate the CA certificate, but the prompts may be avoided by using the command line options\&.
.sp
By default, the \fBgrid\-ca\-create\fR program creates the self\-signed CA certificate, installs it on the current machine in its trusted certificate directory, and creates a source tarball which can be used to generate an RPM package for the CA\&. If the RPM package is installed on a machine, users on that machine can create certificate requests for user, host, or service identity certificates to be signed by the CA certificate generated by running \fBgrid\-ca\-create\fR\&.
.sp
If run as a privileged user, the \fBgrid\-ca\-create\fR program creates the CA certificate and support files in the CA certificate and signing policy are installed in the /etc/grid\-security directory\&. Otherwise, the files are
.SH "OPTIONS"
.sp
The full set of command\-line options to \fBgrid\-ca\-create\fR follows\&. In addition to these, unknown options will be passed to the openssl command when creating the self\-signed certificate\&.
.PP
\fB\-help, \-h, \-usage\fR
.RS 4
Display the command\-line options to
\fBgrid\-ca\-create\fR
and exit\&.
.RE
.PP
\fB\-version, \-versions\fR
.RS 4
Display the version number of the
\fBgrid\-ca\-create\fR
command\&. The second form includes more details\&.
.RE
.PP
\fB\-force\fR
.RS 4
Overwite existing CA in the destination directory if one exists\&.
.RE
.PP
\fB\-bits BITS\fR
.RS 4
Create a CA certificate with a BITS long RSA key [4096]
.RE
.PP
\fB\-noint\fR
.RS 4
Run in non\-interactive mode\&. This will choose defaults for parameters or those specified on the command line without prompting\&. This option also implies
\fI\-force\fR\&.
.RE
.PP
\fB\-dir \fR\fB\fIDIRECTORY\fR\fR
.RS 4
Create the CA in
\fIDIRECTORY\fR\&. The
\fIDIRECTORY\fR
must not exist prior to running
\fBgrid\-ca\-create\fR\&.
.RE
.PP
\fB\-subject \fR\fB\fISUBJECT\fR\fR
.RS 4
Use
\fISUBJECT\fR
as the subject name of the self\-signed CA to create\&. If this is not specified on the command\-line,
\fBgrid\-ca\-create\fR
will default to using the subject name
cn=Globus Simple CA, ou=$HOSTNAME, ou=GlobusTest, o=Grid\&.
.RE
.PP
\fB\-email \fR\fB\fIADDRESS\fR\fR
.RS 4
Use
\fIADDRESS\fR
as the email address of the CA\&. The default instructions generated by
\fBgrid\-ca\-create\fR
tell users to mail the certificate request to this address\&. If this is not specified on the command\-line,
\fBgrid\-ca\-create\fR
will default to
$LOGNAME@$HOSTNAME\&.
.RE
.PP
\fB\-days \fR\fB\fIDAYS\fR\fR
.RS 4
Set the default lifetime of the self\-signed CA certificate to
\fIDAYS\fR\&. If not set, the
\fBgrid\-ca\-create\fR
program will default to
1825
days (5 years)\&.
.RE
.PP
\fB\-pass \fR\fB\fIPASSWORD\fR\fR
.RS 4
Use the string
\fIPASSWORD\fR
to protect the CA\(cqs private key\&. This is useful for automating Simple CA, but may make it easier to compromise the CA if someone obtains a shell on the machine storing the CA\(cqs private key\&.
.RE
.PP
\fB\-nobuild\fR
.RS 4
Disable building a source tarball for distributing the CA\(cqs public information to other machines\&. The source tarball can be created later by using the
\fBgrid\-ca\-package\fR
command\&.
.RE
.PP
\fB\-g\fR
.RS 4
Create a binary GPT package containing the new CA\(cqs public information\&. The package will be created in the current working directory\&. This package can be deployed by with the
\fBgpt\-install\fR
tool\&.
.RE
.PP
\fB\-b\fR
.RS 4
Create a binary GPT package containing the new CA\(cqs public information that is backward\-compatible with GPT 3\&.2\&. Packages created in this manner will work with Globus Toolkit 2\&.0\&.0\-5\&.0\&.x\&.
.RE
.SH "EXAMPLES"
.sp
Create a simple CA in $HOME/SimpleCA:
.sp
.if n \{\
.RS 4
.\}
.nf
% grid\-ca\-create \-noint \-dir $HOME/SimpleCA
.fi
.if n \{\
.RE
.\}
.sp
.if n \{\
.RS 4
.\}
.nf
C e r t i f i c a t e A u t h o r i t y S e t u p
.fi
.if n \{\
.RE
.\}
.sp
.if n \{\
.RS 4
.\}
.nf
This script will setup a Certificate Authority for signing Globus
users certificates\&. It will also generate a simple CA package
that can be distributed to the users of the CA\&.
.fi
.if n \{\
.RE
.\}
.sp
.if n \{\
.RS 4
.\}
.nf
The CA information about the certificates it distributes will
be kept in:
.fi
.if n \{\
.RE
.\}
.sp
.if n \{\
.RS 4
.\}
.nf
/home/juser/SimpleCA
.fi
.if n \{\
.RE
.\}
.sp
.if n \{\
.RS 4
.\}
.nf
The unique subject name for this CA is:
.fi
.if n \{\
.RE
.\}
.sp
.if n \{\
.RS 4
.\}
.nf
cn=Globus Simple CA, ou=simpleCA\-grid\&.example\&.org, ou=GlobusTest, o=Grid
.fi
.if n \{\
.RE
.\}
.sp
.if n \{\
.RS 4
.\}
.nf
Insufficient permissions to install CA into the trusted certifiicate
directory (tried ${sysconfdir}/grid\-security/certificates and
${datadir}/certificates)
Creating RPM source tarball\&.\&.\&. done
globus_simple_ca_0146c503\&.tar\&.gz
.fi
.if n \{\
.RE
.\}
.SH "ENVIRONMENT"
.sp
The following environment variables affect the execution of \fBgrid\-ca\-create\fR:
.PP
GLOBUS_LOCATION
.RS 4
Non\-standard installation path of the Grid Community Toolkit\&.
.RE
.SH "SEE ALSO"
.sp
grid\-cert\-request(1), grid\-ca\-sign(1), grid\-default\-ca(1), grid\-ca\-package(1)
.SH "AUTHOR"
.sp
Copyright \(co 1999\-2014 University of Chicago
|