VDT logo
Search:

(Powered by Google)

Note: This version of the VDT (1.8.1) is supported, but is not our latest stable release. The current stable release is 1.10.1.

CA Certificates in the VDT

Table of Contents

General Information

The VDT team updates the VDT CA certificate package independently of the rest of the VDT. When updates are announced, follow the instructions below to get them.

To find out what VDT version you have: 

$ vdt-version | head -1
You have installed a subset of VDT version 1.8.1a:

To find out what version of the VDT-distributed CA certificates you have: 

$ vdt-version | grep -i certificates
    CA Certificates v49 (includes IGTF IGTF 1.29 CAs)

Updating CA Certificates

Using the automatic updater

The most reliable method to update the certificates is to use our automatic updater. It's been available since VDT 1.8.0. You know it is installed if $VDT_LOCATION/vdt/sbin/vdt-update-certs exists. If it is not installed, you can install it with: 

$ pacman -get http://vdt.cs.wisc.edu/vdt_181_cache:CA-Certificates-Updater

If you installed as root, you can run it automatically via cron. It runs once per day, and your certificates will be kept up to date. You can also run it manually if you prefer. Just run: 

$ cd $VDT_LOCATION
$ vdt/sbin/vdt-update-certs

Choosing a CA certificate distribution

As of September 11, 2008, the OSG GOC now maintains a CA certificate distribution recommended by the OSG Security Team. The VDT will continue to distribute the CA certificates as well, however, in the near future (exact date to be announced), the VDT will ship a convenience distribution of CA certificates which will be the set of IGTF-accredited CA certificates. (Please note that this means we will not be distributing the TeraGrid CAs or the Fermilab KCA anymore, just the IGTF-accredited CAs.) For VDT 1.8.1, the default is to use the VDT's distribution. If you wish to switch to the GOC distribution, you can make the a change in your vdt-update-certs configuration file to do so:
  1. Edit $VDT_LOCATION/vdt/etc/vdt-update-certs.conf
    Insert the following line: 
    cacerts_url = http://software.grid.iu.edu/pacman/cadist/ca-certs-version
  2. Run vdt-update-certs to fetch the GOCs certificates. 
    vdt-update-certs --force

More information on vdt-update-certs...

Using RPM

If you prefer to use an RPM, there is a single RPM containing all of the CA certificates distributed by the VDT. You can install the RPM manually or with yum. The certificates will be installed in /etc/grid-security/certificates. Please note two caveats if you install with RPM. First, you should tell the VDT not to install the CA certificates via Pacman. Second, vdt-version will not report the correct version of the installed certificates.

Installing the VDT CA Certificate RPM manually

# rpm -ivh http://vdt.cs.wisc.edu/vdt_rpms/vdt-ca-certs/vdt-ca-certs-49-1.noarch.rpm

If you wish to download older versions of the RPM, you can find them here.

Direct link to vdt-ca-certs-49-1.noarch.rpm (The latest version)

Installing the VDT CA Certificates with YUM

  1. Tell yum about the VDT CA Certificate repository by adding a file named /etc/yum.repos.d/vdt-ca-certs.repo. Download vdt-ca-certs.repo
  2. Install the CA Certificates: 
    yum install vdt-ca-certs
  3. Update the CA Certificates (if they are already installed): 
    yum update vdt-ca-certs

Note that YUM can do automatic updates. One some RedHat variants, you can install a yum-cron package, which makes a cron job in /etc/cron.daily to update YUM packages automatically.

Using Pacman

If for some reason you do not with to use the automatic updater, you can use Pacman. In our experience, this method almost always works, but has occasional failures. 

$ cd $VDT_LOCATION
$ pacman -update CA-Certificates
About to begin uninstalling [...:CA-Certificates]...
...
Package [...:CA-Certificates] successfully installed...

Removing a Certificate Authority

If you do not trust a Certificate Authority, and would like to remove it from the distribution, follow these steps:

  1. Determine the hash of the CA you would like to remove. For the example below we will assume the hash is "12345678"
  2. Find the files associated with that hash 
    # ls $VDT_LOCATION/globus/TRUSTED_CA/12345678.*
12345678.0
12345678.crl_url
12345678.info
12345678.namespaces
12345678.r0
12345678.signing_policy
  3. Edit $VDT_LOCATION/vdt/etc/vdt-update-certs.conf, and add these files to the exclude section. This will automatically remove these files anytime vdt-update-certs installs a new certificate distribution. 
    exclude=12345678.0
exclude=12345678.crl_url
exclude=12345678.info
exclude=12345678.namespaces
exclude=12345678.r0
exclude=12345678.signing_policy
  4. Remove these files from the current distribution. 
    rm $VDT_LOCATION/globus/TRUSTED_CA/12345678.*

Custom installation

At install time, you have the choice to install your certificates into the "root" location (/etc/grid-security), or the "local" location, ($VDT_LOCATION/globus/share). If you would like to install your certificates into a custom location, for example, in order to put them on a shared filesystem, you can do the following setup:

  1. Install the certificates locally. This will install them to $VDT_LOCATION/globus/share
  2. Create a directory in your shared filesystem to hold the certificates. Assume your desired location is, for example, /nfs/ca-certs.
  3. Move the certificates from $VDT_LOCATION/globus/share to /nfs/ca-certs 
    cd $VDT_LOCATION/globus/share
mv certificates-49-1 /nfs/ca-certs/
rm certificates
cd /nfs/ca-certs
ln -s /nfs/ca-certs/certificates-49-1 certificates
  4. Update the $VDT_LOCATION/globus/TRUSTED_CA link: 
    cd $VDT_LOCATION/globus
rm TRUSTED_CA
ln -s /nfs/ca-certs/certificates TRUSTED_CA

Change Log

Curious about what has changed in each CA certificate release?

CA certificate change log

CAs in CA-Certificates v49 (IGTF 1.29 and TeraGrid)

View the contents of a different release:

Hash Description Contact Source
03aa0ecbBelgium - BeGridhttps://gridra.belnet.be/pub/IGTF
09ff08b7CNRS-Projetshttp://igc.services.cnrs.fr/GRID-FR/IGTF
0a12b607UGrid - Ukrainehttps://ca.ugrid.org/IGTF
0a2bac92Brazil - BrGridhttps://brgridca.ic.uff.br/IGTF
1149214eGermany - DFN-GridGermany-Roothttp://www.pca.dfn.de/IGTF
11b4a5a2Portugal - LIPCAhttp://ca.lip.pt/IGTF
12a1d8c2France - GRID-FRhttp://igc.services.cnrs.fr/GRID-FR/IGTF
163af95cCNRS2http://igc.services.cnrs.fr/GRID-FR/IGTF
1691b9baTurkey - TRGridhttp://www.grid.org.tr/ca/IGTF
16da7552The Netherlands - NIKHEFhttp://certificate.nikhef.nl/IGTF
1c3f2ca8USA - DOE Gridshttp://www.doegrids.org/IGTF
1d879c6cCERN-TCAhttp://www.cern.ch/caIGTF
1e12d831APAChttp://www.vpac.org/twiki/bin/view/APACgrid/CaInterfaceIGTF
1e43b9ccIreland - Grid-Irelandhttp://www.cs.tcd.ie/grid-ireland/gi-ca/IGTF
1f0e8352Nordic countries - NorduGridhttp://hep.nbi.dk/CA/IGTF
1f3834d0RomanianGRID - Romaniahttp://www.romaniangrid.roIGTF
2418a3f3BG-ACAD (Bulgarian Academic CA)http://www.ca.acad.bg/IGTF
24c3ccdeUNAM Grid - Mexicohttp://ca.unamgrid.unam.mx/IGTF
28a58577Greece - HellasGrid (Root 2006)http://www.grid.auth.gr/pki/hellasgrid-root-ca-2006/IGTF
295adc19Chile - REUNA CAhttp://reuna-ca.reuna.cl/IGTF
2a237f16Baltic States - Baltic Grid CAhttp://ca.balticgrid.org/IGTF
2ac09305TACC MICShttp://www.tacc.utexas.edu/CA/IGTF
2f3fadf6INFNhttp://security.fi.infn.it/CA/IGTF
304cf809SWITCHslcshttp://www.switch.ch/pki/gridIGTF
3232b9bcMREN - Montenegrohttp://mren-ca.ac.me/IGTF
34a509c3France - CNRS-Projetshttp://igc.services.cnrs.fr/IGTF
34f8e29cGermany - DFN-GridGermany-Userhttp://www.pca.dfn.de/IGTF
367b75c3UK eScience CA 2007http://www.grid-support.ac.uk/ca/IGTF
393f7863Serbia - AEGIShttp://aegis-ca.rcub.bg.ac.yu/IGTF
3d5be7bcSlovenia - SiGNET CAhttp://signet-ca.ijs.si/IGTF
3f0f4285Venezuela - ULAGrid CAhttp://ra.cecalc.ula.veIGTF
71a89a47NCHChttp://ca.goc.nchc.org.tw/IGTF
468d15b3Balkans - SeeGridhttp://www.grid.auth.gr/pki/seegrid-ca/IGTF
4798da47HKUhttp://ca.grid.hku.hk/IGTF
47d3d1a0SWITCH-Personal-2007http://swisssign.netIGTF
55994d72Russia - RDIGhttp://ca.grid.kiae.ru/RDIG/IGTF
5cf9d536QuoVadis-Root-CA1http://www.switch.ch/pki/IGTF
5e5501f3Hungary - KFKI RMKIhttp://pki.kfki.hu/IGTF
617ff41bJapan - KEKhttps://gridca.kek.jp/IGTF
684261aaUS - TACC Roothttp://www.tacc.utexas.edu/CA/IGTF
6e3b436bAustria - AustrianGridhttps://ca.austriangridca.at/IGTF
6fee79b0Israel - IUCChttp://certificate.iucc.ac.il/IGTF
709bed08BYGCAhttp://ca.grid.by/IGTF
722e5071Korea - KISTI 2007http://ca.gridcenter.or.kr/IGTF
742edd45Latvia - LatGridhttp://grid.lumii.lv/?lang=enIGTF
7721d4d3PRAGMA-UCSDhttp://goc.pragma-grid.net/ca/IGTF
7b2d086cSwitzerland - SwissSign (Root)http://swisssign.net/IGTF
7b54708eMorocco: MAGrid CAhttp://www.magrid.ma/caIGTF
7d0d064aMARGI - Macedoniahttp://www.margi-ca.marnet.net.mkIGTF
82b36fcaGreece - HellasGrid (2006)http://www.grid.auth.gr/pki/hellasgrid-root-ca-2006/IGTF
8a047de1NECTEC GOChttp://gridca.hpcc.nectec.or.th/IGTF
8a661490Poland - PolishGridhttp://www.man.poznan.pl/plgrid-ca/IGTF
98ef0ee5UK eScience Root CA 2007http://www.grid-support.ac.uk/ca/IGTF
9b59ecadCzech Republic - CESNEThttp://www.cesnet.cz/pki/IGTF
9b95bbf2USA - NCSA MICShttp://security.ncsa.uiuc.edu/CA/IGTF
9cd75e87Academia Sinica Grid CA 2007http://ca.grid.sinica.edu.tw/IGTF
9dd23746pkIRISGRIDhttp://www.irisgrid.es/pki/IGTF
9ff26ea4MD-Gridhttp://ca.grid.md/IGTF
a02131f7DFN-SLCShttp://www.pki.dfn.de/index.php?id=slcsIGTF
a317c467Japan - AISThttps://www.apgrid.org/CA/AIST/Production/IGTF
a87d9192Japan - NAREGIhttps://www.naregi.org/ca/IGTF
a9082267Latin American and Caribbean Catch-all Grid CAhttp://lacgridca.ic.uff.br/IGTF
afe55e66Cyprus - CyGridhttp://grid.ucy.ac.cy/CyGridCA/IGTF
b2771d44China - CNIC Grid CAhttp://ca.grid.cn/en/IGTF
b7bcb7b2Argentina - UNPL Grid CAhttps://www.pkigrid.unlp.edu.ar/IGTF
ba2f39caChina - IHEPhttps://gridca.ihep.ac.cn/IGTF
b93d6240NERSC SLCS CAhttp://certs.nersc.gov/IGTF
bffbd7d0GridCanadahttp://www.gridcanada.ca/caIGTF
ce33db76IRAN-GRIDhttp://cagrid.ipm.ac.ir/IGTF
c4435d12Switzerland - SwissSign (SWITCH)http://swisssign.net/IGTF
c48c63f3China - CNIC SDG CAhttp://ca.sdg.grid.cn/en/IGTF
cc800af0Hungary - NIIFhttp://www.ca.niif.hu/IGTF
cf4ba8c8France - CNRS (EDG Catch-all CA)http://igc.services.cnrs.fr/IGTF
d0c2a341Armenia - ArmeSFohttp://www.escience.am/ca/IGTF
d0b701c0SWITCHGrid Roothttp://www.switch.ch/pki/gridIGTF
d11f973eCNRS2-Grid-FRhttp://igc.services.cnrs.fr/GRID-FR/IGTF
d1737728NGO-Netrusthttp://netrustconnector.netrust.net/IGTF
d1b603c3US - ESnet Roothttp://www.doegrids.org/IGTF
d254cc30CERN-ROOThttp://www.cern.ch/caIGTF
da75f6a8Indian Grid CAhttp://ca.garudaindia.in/IGTF
dd4b34eaGermany - GermanGridhttp://grid.fzk.de/IGTF
e13e0fcfSlovakia - SlovakGridhttp://ups.savba.sk/ca/IGTF
e1fce4e9Fermilab KCA CAhttps://computing.fnal.gov/security/pki/IGTF
e36e7a72Switzerland - SwissSign (Bronze)http://swisssign.net/IGTF
e5cc84c2US - TACC Roothttp://www.tacc.utexas.edu/CA/IGTF
e72045ceSWITCH-QuoVadis-Grid-ICAhttp://www.switch.ch/grid/certificates/IGTF
e8ac4b61NCSA GridShib CAhttp://security.ncsa.uiuc.edu/CA/IGTF
e8d818e6BEGrid2008https://gridra.begrid.be/IGTF
e9d08b40Switzerland - SwissSign (Silver)http://swisssign.net/IGTF
eebc7717SWITCH-Server-2007http://swisssign.net/IGTF
f2e89fe3USA - NCSA SLCShttp://security.ncsa.uiuc.edu/CA/IGTF
f5ead794PK-Grid-2007http://www.ncp.edu.pk/pk-grid-ca/IGTF
fe102e03Germany - DFN-GridGermany-Serverhttp://www.pca.dfn.de/IGTF
ff94d436Croatia - SRCEhttp://ra.srce.hr/IGTF