VDT logo
Search:

(Powered by Google)

CA Certificates in the VDT

Table of Contents

General Information

Version

The VDT team updates the VDT CA certificate package independently of the rest of the VDT. When updates are announced, follow the instructions below to get them.

To find out what VDT version you have: 

$ vdt-version | head -1
You have installed a subset of VDT version 1.10.1c:

To find out more information about your certificates, including information about vdt-update-certs and fetch-crl, run vdt-ca-certs-status. For example: 

$ vdt-ca-certs-status

CA-Certificates Info:
    Version: 36-1

vdt-update-certs info:
    Last run: 2008-06-12T08-48-28
    Last updated: 2008-06-12T08-48-28
    Status: Installed and running

Fetch-CRL info:
    Last run: 2008-06-12T08-44-27
    Status: Installed and running

To find out the full version of the VDT-distributed CA certificates you have: 

$ vdt-version | grep -i certificates
    CA Certificates v49 (includes IGTF IGTF 1.29 CAs)

Installing the CA-Certificates

As of September 11, 2008, VDT 1.10.1 and later will no longer automatically install certificate authority certificates during installation. Why are we doing this? The VDT installation (outside of the OSG software stack) is intended to be a grid-agnostic software stack, but the set of Certificate Authorities you trust is a combination of the grid you are a member of and what CAs you personally trust. By making these changes, we do two things:

As of February 2nd, 2009 the VDT's CA distribution dropped all non-IGTF accredited CAs. Is is now only a convenience distribution of CA certificates. However, you (the user) will be required to select this distribution if it is what you want instead of another distribution. The VDT Team will provide this as a convenience, but not as a recommendation. Details on this transition

As an alternative, you will be able to fetch CA certificates from the GOC.

In order to complete the certificate installation, perform the following steps:

  1. Edit the value of cacerts_url in the configuration file at $VDT_LOCATION/vdt/etc/vdt-update-certs.conf

    This file contains URLs to CA Certificate distributions including the OSG GOC distribution with certificates recommended by the OSG Security Team, as well as the VDT convenience distribution. You must uncomment one of these (or create your own), and then run the commands below to activate the certificate updates.

  2. Run the following command: 
    . $VDT_LOCATION/vdt-questions.sh; $VDT_LOCATION/vdt/sbin/vdt-setup-ca-certificates

  3. Make sure vdt-update-certs is enabled, and it will fetch future certificate updates automatically. 

    vdt-control --enable vdt-update-certs
vdt-control --on vdt-update-certs

Available Certificate Distributions

Updating CA Certificates

Using the automatic updater

The most reliable method to update the certificates is to use our automatic updater, which is installed along with the CA-Certificates package. It's been available since VDT 1.8.0. You know it is installed if $VDT_LOCATION/vdt/sbin/vdt-update-certs exists. If it is not installed, you can install it with: 

$ pacman -get http://vdt.cs.wisc.edu/vdt_1101_cache:CA-Certificates-Updater

If you installed as root, you can run it automatically via cron to keep your certificates up to date. You can also run it manually if you prefer. Just run: 

$ cd $VDT_LOCATION
$ vdt/sbin/vdt-update-certs

The vdt-update-certs script will check for a new update once per day. It runs hourly from the crontab so that if a check fails due to network problems or any other error, the next hour's check will be able to check for an update rather than waiting 24 hours.

More information on vdt-update-certs.

Using RPM

If you prefer to use an RPM, there is a single RPM containing all of the CA certificates distributed by the VDT. You can install the RPM manually or with yum. The certificates will be installed in /etc/grid-security/certificates. Please note two caveats if you install with RPM. First, you should tell the VDT not to install the CA certificates via Pacman. Second, vdt-version will not report the correct version of the installed certificates.

Installing the VDT CA Certificate RPM manually

# rpm -ivh http://vdt.cs.wisc.edu/vdt_rpms/vdt-ca-certs/vdt-ca-certs-49-1.noarch.rpm

If you wish to download older versions of the RPM, you can find them here.

Direct link to vdt-ca-certs-49-1.noarch.rpm (The latest version)

Installing the VDT CA Certificates with YUM

  1. Tell yum about the VDT CA Certificate repository by adding a file named /etc/yum.repos.d/vdt-ca-certs.repo. Download vdt-ca-certs.repo
  2. Install the CA Certificates: 
    yum install vdt-ca-certs
  3. Update the CA Certificates (if they are already installed): 
    yum update vdt-ca-certs

Note that YUM can do automatic updates. One some RedHat variants, you can install a yum-cron package, which makes a cron job in /etc/cron.daily to update YUM packages automatically.

Removing a Certificate Authority

If you do not trust a Certificate Authority, and would like to remove it from the distribution, follow these steps:

  1. Determine the hash of the CA you would like to remove. For the example below we will assume the hash is "12345678"
  2. Edit $VDT_LOCATION/vdt/etc/vdt-update-certs.conf, and add an exclude_ca statement for this hash. This will automatically remove any files associated with this hash anytime vdt-update-certs installs a new certificate distribution. 
    exclude_ca=12345678
  3. Remove the files from the current distribution. 
    rm $VDT_LOCATION/globus/TRUSTED_CA/12345678.*

Custom installation

At install time, you have the choice to install your certificates into the "root" location (/etc/grid-security), or the "local" location, ($VDT_LOCATION/globus/share). If you would like to install your certificates into a custom location, for example, in order to put them on a shared filesystem, you can do the following setup:

  1. Install the certificates locally. This will install them to $VDT_LOCATION/globus/share
  2. Create a directory in your shared filesystem to hold the certificates. Assume your desired location is, for example, /nfs/ca-certs.
  3. Move the certificates from $VDT_LOCATION/globus/share to /nfs/ca-certs 
    cd $VDT_LOCATION/globus/share
mv certificates-49-1 /nfs/ca-certs/
rm certificates
cd /nfs/ca-certs
ln -s /nfs/ca-certs/certificates-49-1 certificates
  4. Update the $VDT_LOCATION/globus/TRUSTED_CA link: 
    cd $VDT_LOCATION/globus
rm TRUSTED_CA
ln -s /nfs/ca-certs/certificates TRUSTED_CA

Certificate Revocation Lists (CRLs)

The certificate revocation list (CRL) is a list of certificates which have been revoked and are no longer valid. They are updated by the Fetch CRL program, which can be enabled by vdt-control to run from your crontab. To get more information about fetch-crl, run the vdt-ca-certs-status command. This will report when Fetch-CRL last ran and if it is currently running from the crontab. 
# An example of everything setup and running correctly.

$ vdt-ca-certs-status 
<snip>

Fetch-CRL info:
    Last run: 2008-06-11T17-59-59
    Status: Installed and running



# Watch for errors similar to the messages below.

$ vdt-ca-certs-status 
<snip>

Fetch-CRL info:
    Last run: 2008-05-20T05-11-07
    WARNING: fetch-crl has not run in over 48 hours
    Status: Installed, but not running via root's crontab

Change Log

Curious about what has changed in each CA certificate release?

CA certificate change log

CAs in CA-Certificates v49 (IGTF 1.29 and TeraGrid)

View the contents of a different release:

Hash Description Contact Source
03aa0ecbBelgium - BeGridhttps://gridra.belnet.be/pub/IGTF
09ff08b7CNRS-Projetshttp://igc.services.cnrs.fr/GRID-FR/IGTF
0a12b607UGrid - Ukrainehttps://ca.ugrid.org/IGTF
0a2bac92Brazil - BrGridhttps://brgridca.ic.uff.br/IGTF
1149214eGermany - DFN-GridGermany-Roothttp://www.pca.dfn.de/IGTF
11b4a5a2Portugal - LIPCAhttp://ca.lip.pt/IGTF
12a1d8c2France - GRID-FRhttp://igc.services.cnrs.fr/GRID-FR/IGTF
163af95cCNRS2http://igc.services.cnrs.fr/GRID-FR/IGTF
1691b9baTurkey - TRGridhttp://www.grid.org.tr/ca/IGTF
16da7552The Netherlands - NIKHEFhttp://certificate.nikhef.nl/IGTF
1c3f2ca8USA - DOE Gridshttp://www.doegrids.org/IGTF
1d879c6cCERN-TCAhttp://www.cern.ch/caIGTF
1e12d831APAChttp://www.vpac.org/twiki/bin/view/APACgrid/CaInterfaceIGTF
1e43b9ccIreland - Grid-Irelandhttp://www.cs.tcd.ie/grid-ireland/gi-ca/IGTF
1f0e8352Nordic countries - NorduGridhttp://hep.nbi.dk/CA/IGTF
1f3834d0RomanianGRID - Romaniahttp://www.romaniangrid.roIGTF
2418a3f3BG-ACAD (Bulgarian Academic CA)http://www.ca.acad.bg/IGTF
24c3ccdeUNAM Grid - Mexicohttp://ca.unamgrid.unam.mx/IGTF
28a58577Greece - HellasGrid (Root 2006)http://www.grid.auth.gr/pki/hellasgrid-root-ca-2006/IGTF
295adc19Chile - REUNA CAhttp://reuna-ca.reuna.cl/IGTF
2a237f16Baltic States - Baltic Grid CAhttp://ca.balticgrid.org/IGTF
2ac09305TACC MICShttp://www.tacc.utexas.edu/CA/IGTF
2f3fadf6INFNhttp://security.fi.infn.it/CA/IGTF
304cf809SWITCHslcshttp://www.switch.ch/pki/gridIGTF
3232b9bcMREN - Montenegrohttp://mren-ca.ac.me/IGTF
34a509c3France - CNRS-Projetshttp://igc.services.cnrs.fr/IGTF
34f8e29cGermany - DFN-GridGermany-Userhttp://www.pca.dfn.de/IGTF
367b75c3UK eScience CA 2007http://www.grid-support.ac.uk/ca/IGTF
393f7863Serbia - AEGIShttp://aegis-ca.rcub.bg.ac.yu/IGTF
3d5be7bcSlovenia - SiGNET CAhttp://signet-ca.ijs.si/IGTF
3f0f4285Venezuela - ULAGrid CAhttp://ra.cecalc.ula.veIGTF
71a89a47NCHChttp://ca.goc.nchc.org.tw/IGTF
468d15b3Balkans - SeeGridhttp://www.grid.auth.gr/pki/seegrid-ca/IGTF
4798da47HKUhttp://ca.grid.hku.hk/IGTF
47d3d1a0SWITCH-Personal-2007http://swisssign.netIGTF
55994d72Russia - RDIGhttp://ca.grid.kiae.ru/RDIG/IGTF
5cf9d536QuoVadis-Root-CA1http://www.switch.ch/pki/IGTF
5e5501f3Hungary - KFKI RMKIhttp://pki.kfki.hu/IGTF
617ff41bJapan - KEKhttps://gridca.kek.jp/IGTF
684261aaUS - TACC Roothttp://www.tacc.utexas.edu/CA/IGTF
6e3b436bAustria - AustrianGridhttps://ca.austriangridca.at/IGTF
6fee79b0Israel - IUCChttp://certificate.iucc.ac.il/IGTF
709bed08BYGCAhttp://ca.grid.by/IGTF
722e5071Korea - KISTI 2007http://ca.gridcenter.or.kr/IGTF
742edd45Latvia - LatGridhttp://grid.lumii.lv/?lang=enIGTF
7721d4d3PRAGMA-UCSDhttp://goc.pragma-grid.net/ca/IGTF
7b2d086cSwitzerland - SwissSign (Root)http://swisssign.net/IGTF
7b54708eMorocco: MAGrid CAhttp://www.magrid.ma/caIGTF
7d0d064aMARGI - Macedoniahttp://www.margi-ca.marnet.net.mkIGTF
82b36fcaGreece - HellasGrid (2006)http://www.grid.auth.gr/pki/hellasgrid-root-ca-2006/IGTF
8a047de1NECTEC GOChttp://gridca.hpcc.nectec.or.th/IGTF
8a661490Poland - PolishGridhttp://www.man.poznan.pl/plgrid-ca/IGTF
98ef0ee5UK eScience Root CA 2007http://www.grid-support.ac.uk/ca/IGTF
9b59ecadCzech Republic - CESNEThttp://www.cesnet.cz/pki/IGTF
9b95bbf2USA - NCSA MICShttp://security.ncsa.uiuc.edu/CA/IGTF
9cd75e87Academia Sinica Grid CA 2007http://ca.grid.sinica.edu.tw/IGTF
9dd23746pkIRISGRIDhttp://www.irisgrid.es/pki/IGTF
9ff26ea4MD-Gridhttp://ca.grid.md/IGTF
a02131f7DFN-SLCShttp://www.pki.dfn.de/index.php?id=slcsIGTF
a317c467Japan - AISThttps://www.apgrid.org/CA/AIST/Production/IGTF
a87d9192Japan - NAREGIhttps://www.naregi.org/ca/IGTF
a9082267Latin American and Caribbean Catch-all Grid CAhttp://lacgridca.ic.uff.br/IGTF
afe55e66Cyprus - CyGridhttp://grid.ucy.ac.cy/CyGridCA/IGTF
b2771d44China - CNIC Grid CAhttp://ca.grid.cn/en/IGTF
b7bcb7b2Argentina - UNPL Grid CAhttps://www.pkigrid.unlp.edu.ar/IGTF
ba2f39caChina - IHEPhttps://gridca.ihep.ac.cn/IGTF
b93d6240NERSC SLCS CAhttp://certs.nersc.gov/IGTF
bffbd7d0GridCanadahttp://www.gridcanada.ca/caIGTF
ce33db76IRAN-GRIDhttp://cagrid.ipm.ac.ir/IGTF
c4435d12Switzerland - SwissSign (SWITCH)http://swisssign.net/IGTF
c48c63f3China - CNIC SDG CAhttp://ca.sdg.grid.cn/en/IGTF
cc800af0Hungary - NIIFhttp://www.ca.niif.hu/IGTF
cf4ba8c8France - CNRS (EDG Catch-all CA)http://igc.services.cnrs.fr/IGTF
d0c2a341Armenia - ArmeSFohttp://www.escience.am/ca/IGTF
d0b701c0SWITCHGrid Roothttp://www.switch.ch/pki/gridIGTF
d11f973eCNRS2-Grid-FRhttp://igc.services.cnrs.fr/GRID-FR/IGTF
d1737728NGO-Netrusthttp://netrustconnector.netrust.net/IGTF
d1b603c3US - ESnet Roothttp://www.doegrids.org/IGTF
d254cc30CERN-ROOThttp://www.cern.ch/caIGTF
da75f6a8Indian Grid CAhttp://ca.garudaindia.in/IGTF
dd4b34eaGermany - GermanGridhttp://grid.fzk.de/IGTF
e13e0fcfSlovakia - SlovakGridhttp://ups.savba.sk/ca/IGTF
e1fce4e9Fermilab KCA CAhttps://computing.fnal.gov/security/pki/IGTF
e36e7a72Switzerland - SwissSign (Bronze)http://swisssign.net/IGTF
e5cc84c2US - TACC Roothttp://www.tacc.utexas.edu/CA/IGTF
e72045ceSWITCH-QuoVadis-Grid-ICAhttp://www.switch.ch/grid/certificates/IGTF
e8ac4b61NCSA GridShib CAhttp://security.ncsa.uiuc.edu/CA/IGTF
e8d818e6BEGrid2008https://gridra.begrid.be/IGTF
e9d08b40Switzerland - SwissSign (Silver)http://swisssign.net/IGTF
eebc7717SWITCH-Server-2007http://swisssign.net/IGTF
f2e89fe3USA - NCSA SLCShttp://security.ncsa.uiuc.edu/CA/IGTF
f5ead794PK-Grid-2007http://www.ncp.edu.pk/pk-grid-ca/IGTF
fe102e03Germany - DFN-GridGermany-Serverhttp://www.pca.dfn.de/IGTF
ff94d436Croatia - SRCEhttp://ra.srce.hr/IGTF