VDT logo
Search:

(Powered by Google)

Note: This version of the VDT (1.8.1) is supported, but is not our latest stable release. The current stable release is 1.10.1.

CA Certificates in the VDT

Table of Contents

General Information

The VDT team updates the VDT CA certificate package independently of the rest of the VDT. When updates are announced, follow the instructions below to get them.

To find out what VDT version you have: 

$ vdt-version | head -1
You have installed a subset of VDT version 1.8.1a:

To find out what version of the VDT-distributed CA certificates you have: 

$ vdt-version | grep -i certificates
    CA Certificates v39 (includes IGTF IGTF 1.24 CAs)

Updating CA Certificates

Using the automatic updater

The most reliable method to update the certificates is to use our automatic updater. It's been available since VDT 1.8.0. You know it is installed if $VDT_LOCATION/vdt/sbin/vdt-update-certs exists. If it is not installed, you can install it with: 

$ pacman -get http://vdt.cs.wisc.edu/vdt_181_cache:CA-Certificates-Updater

If you installed as root, you can run it automatically via cron. It runs once per day, and your certificates will be kept up to date. You can also run it manually if you prefer. Just run: 

$ cd $VDT_LOCATION
$ vdt/sbin/vdt-update-certs

More information on vdt-update-certs...

Using RPM

If you prefer to use an RPM, there is a single RPM containing all of the CA certificates distributed by the VDT. You can install the RPM manually or with yum. The certificates will be installed in /etc/grid-security/certificates. Please note two caveats if you install with RPM. First, you should tell the VDT not to install the CA certificates via Pacman. Second, vdt-version will not report the correct version of the installed certificates.

Installing the VDT CA Certificate RPM manually

# rpm -ivh http://vdt.cs.wisc.edu/vdt_rpms/vdt-ca-certs/vdt-ca-certs-39-2.noarch.rpm

If you wish to download older versions of the RPM, you can find them here.

Direct link to vdt-ca-certs-39-2.noarch.rpm (The latest version)

Installing the VDT CA Certificates with YUM

  1. Tell yum about the VDT CA Certificate repository by adding a file named /etc/yum.repos.d/vdt-ca-certs.repo. Download vdt-ca-certs.repo
  2. Install the CA Certificates: 
    yum install vdt-ca-certs
  3. Update the CA Certificates (if they are already installed): 
    yum update vdt-ca-certs

Note that YUM can do automatic updates. One some RedHat variants, you can install a yum-cron package, which makes a cron job in /etc/cron.daily to update YUM packages automatically.

Using Pacman

If for some reason you do not with to use the automatic updater, you can use Pacman. In our experience, this method almost always works, but has occasional failures. 

$ cd $VDT_LOCATION
$ pacman -update CA-Certificates
About to begin uninstalling [...:CA-Certificates]...
...
Package [...:CA-Certificates] successfully installed...

Removing a Certificate Authority

If you do not trust a Certificate Authority, and would like to remove it from the distribution, follow these steps:

  1. Determine the hash of the CA you would like to remove. For the example below we will assume the hash is "12345678"
  2. Find the files associated with that hash 
    # ls $VDT_LOCATION/globus/TRUSTED_CA/12345678.*
12345678.0
12345678.crl_url
12345678.info
12345678.namespaces
12345678.r0
12345678.signing_policy
  3. Edit $VDT_LOCATION/vdt/etc/vdt-update-certs.conf, and add these files to the exclude section. This will automatically remove these files anytime vdt-update-certs installs a new certificate distribution. 
    exclude=12345678.0
exclude=12345678.crl_url
exclude=12345678.info
exclude=12345678.namespaces
exclude=12345678.r0
exclude=12345678.signing_policy
  4. Remove these files from the current distribution. 
    rm $VDT_LOCATION/globus/TRUSTED_CA/12345678.*

Custom installation

At install time, you have the choice to install your certificates into the "root" location (/etc/grid-security), or the "local" location, ($VDT_LOCATION/globus/share). If you would like to install your certificates into a custom location, for example, in order to put them on a shared filesystem, you can do the following setup:

  1. Install the certificates locally. This will install them to $VDT_LOCATION/globus/share
  2. Create a directory in your shared filesystem to hold the certificates. Assume your desired location is, for example, /nfs/ca-certs.
  3. Move the certificates from $VDT_LOCATION/globus/share to /nfs/ca-certs 
    cd $VDT_LOCATION/globus/share
mv certificates-39-2 /nfs/ca-certs/
rm certificates
cd /nfs/ca-certs
ln -s /nfs/ca-certs/certificates-39-2 certificates
  4. Update the $VDT_LOCATION/globus/TRUSTED_CA link: 
    cd $VDT_LOCATION/globus
rm TRUSTED_CA
ln -s /nfs/ca-certs/certificates TRUSTED_CA

Change Log

Curious about what has changed in each CA certificate release?

CA certificate change log

CAs in CA-Certificates v39 (IGTF 1.24 and TeraGrid)

View the contents of a different release:

Hash Description Contact Source
03aa0ecbBelgium - BeGridhttps://gridra.belnet.be/pub/IGTF
0a12b607UGrid - Ukrainehttps://ca.ugrid.org/IGTF
0a2bac92Brazil - BrGridhttps://brgridca.ic.uff.br/IGTF
1149214eGermany - DFN-GridGermany-Roothttp://www.pca.dfn.de/IGTF
11b4a5a2Portugal - LIPCAhttp://ca.lip.pt/IGTF
12a1d8c2France - GRID-FRhttp://igc.services.cnrs.fr/GRID-FR/IGTF
1691b9baTurkey - TRGridhttp://www.grid.org.tr/ca/IGTF
16da7552The Netherlands - NIKHEFhttp://certificate.nikhef.nl/IGTF
1c3f2ca8USA - DOE Gridshttp://www.doegrids.org/IGTF and TeraGrid
1d879c6cCERN-TCAhttp://www.cern.ch/caIGTF
1e12d831APAChttp://www.vpac.org/twiki/bin/view/APACgrid/CaInterfaceIGTF
1e43b9ccIreland - Grid-Irelandhttp://www.cs.tcd.ie/grid-ireland/gi-ca/IGTF
1f0e8352Nordic countries - NorduGridhttp://hep.nbi.dk/CA/IGTF
1f3834d0RomanianGRID - Romaniahttp://www.romaniangrid.roIGTF
2418a3f3BG-ACAD (Bulgarian Academic CA)http://www.ca.acad.bg/IGTF
24c3ccdeUNAM Grid - Mexicohttp://ca.unamgrid.unam.mx/IGTF
28a58577Greece - HellasGrid (Root 2006)http://www.grid.auth.gr/pki/hellasgrid-root-ca-2006/IGTF
290a3b29USA - PSC Kerberos CAhttp://www.psc.edu/ca/TeraGrid
295adc19Chile - REUNA CAhttp://reuna-ca.reuna.cl/IGTF
2a237f16Baltic States - Baltic Grid CAhttp://ca.balticgrid.org/IGTF
2f3fadf6INFNhttp://security.fi.infn.it/CA/IGTF
304cf809SWITCHslcshttp://www.switch.ch/pki/gridIGTF
3232b9bcMREN - Montenegrohttp://mren-ca.ac.me/IGTF
34a509c3France - CNRS-Projetshttp://igc.services.cnrs.fr/IGTF
34f8e29cGermany - DFN-GridGermany-Userhttp://www.pca.dfn.de/IGTF
367b75c3UK eScience CA 2007http://www.grid-support.ac.uk/ca/IGTF
393f7863Serbia - AEGIShttp://aegis-ca.rcub.bg.ac.yu/IGTF
3d5be7bcSlovenia - SiGNET CAhttp://signet-ca.ijs.si/IGTF
3deda549San Diego Supercomputing Centerhttp://www.sdsc.edu/CA/TeraGrid
468d15b3Balkans - SeeGridhttp://www.grid.auth.gr/pki/seegrid-ca/IGTF
47d3d1a0SWITCH-Personal-2007http://swisssign.netIGTF
4a6cd8b1USA - NCSAhttp://security.ncsa.uiuc.edu/CA/IGTF
55994d72Russia - RDIGhttp://ca.grid.kiae.ru/RDIG/IGTF
566bf40fEstonia - Estonian Gridhttp://grid.eenet.ee/IGTF
5e5501f3Hungary - KFKI RMKIhttp://pki.kfki.hu/IGTF
617ff41bJapan - KEKhttps://gridca.kek.jp/IGTF
67e8acfaPurdue TeraGrid RAhttp://tg-ca.purdue.teragrid.org:8080/ejbca/TeraGrid
6e3b436bAustria - AustrianGridhttps://ca.austriangridca.at/IGTF
6fee79b0Israel - IUCChttp://certificate.iucc.ac.il/IGTF
722e5071Korea - KISTI 2007http://ca.gridcenter.or.kr/IGTF
7721d4d3PRAGMA-UCSDhttp://goc.pragma-grid.net/ca/IGTF
7b2d086cSwitzerland - SwissSign (Root)http://swisssign.net/IGTF
7b54708eMorocco: MAGrid CAhttp://www.magrid.ma/caIGTF
7d0d064aMARGI - Macedoniahttp://www.margi-ca.marnet.net.mkIGTF
82b36fcaGreece - HellasGrid (2006)http://www.grid.auth.gr/pki/hellasgrid-root-ca-2006/IGTF
8a047de1NECTEC GOChttp://gridca.hpcc.nectec.or.th/IGTF
8a661490Poland - PolishGridhttp://www.man.poznan.pl/plgrid-ca/IGTF
95009ddcPurdue CAhttp://tg-ca.purdue.teragrid.org:8080/ejbca/TeraGrid
98ef0ee5UK eScience Root CA 2007http://www.grid-support.ac.uk/ca/IGTF
9a1da9f9TACChttp://www.tacc.utexas.edu/CA/TeraGrid
9b59ecadCzech Republic - CESNEThttp://www.cesnet.cz/pki/IGTF
9b88e95bUSA - PSC Root CAhttp://www.psc.edu/ca/TeraGrid
9b95bbf2USA - NCSA MICShttp://security.ncsa.uiuc.edu/CA/IGTF
9cd75e87Academia Sinica Grid CA 2007http://ca.grid.sinica.edu.tw/IGTF
9dd23746pkIRISGRIDhttp://www.irisgrid.es/pki/IGTF
a317c467Japan - AISThttps://www.apgrid.org/CA/AIST/Production/IGTF
a87d9192Japan - NAREGIhttps://www.naregi.org/ca/IGTF
a9082267Latin American and Caribbean Catch-all Grid CAhttp://lacgridca.ic.uff.br/IGTF
acc06fdaUSA - PSC Hosts CAhttp://www.psc.edu/ca/TeraGrid
afe55e66Cyprus - CyGridhttp://grid.ucy.ac.cy/CyGridCA/IGTF
b2771d44China - CNIC Grid CAhttp://ca.grid.cn/en/IGTF
b7bcb7b2Argentina - UNPL Grid CAhttps://www.pkigrid.unlp.edu.ar/IGTF
b89793e4NPACIhttp://www.npaci.edu/CA/TeraGrid
ba2f39caChina - IHEPhttps://gridca.ihep.ac.cn/IGTF
bffbd7d0GridCanadahttp://www.gridcanada.ca/caIGTF
ce33db76IRAN-GRIDhttp://cagrid.ipm.ac.ir/IGTF
c4435d12Switzerland - SwissSign (SWITCH)http://swisssign.net/IGTF
c48c63f3China - CNIC SDG CAhttp://ca.sdg.grid.cn/en/IGTF
cc800af0Hungary - NIIFhttp://www.ca.niif.hu/IGTF
cf4ba8c8France - CNRS (EDG Catch-all CA)http://igc.services.cnrs.fr/IGTF
d0c2a341Armenia - ArmeSFohttp://www.escience.am/ca/IGTF
d0b701c0SWITCHGrid Roothttp://www.switch.ch/pki/gridIGTF
d1737728NGO-Netrusthttp://www.netrust.netIGTF
d1b603c3US - ESnet Roothttp://www.doegrids.org/IGTF and TeraGrid
d254cc30CERN-ROOThttp://www.cern.ch/caIGTF
d2a353a5Pakistan - PK Grid CAhttp://www.ncp.edu.pk/pk-grid-ca/IGTF
dd4b34eaGermany - GermanGridhttp://grid.fzk.de/IGTF
e13e0fcfSlovakia - SlovakGridhttp://ups.savba.sk/ca/IGTF
e1fce4e9Fermilab KCA CAhttps://computing.fnal.gov/security/pki/IGTF
e36e7a72Switzerland - SwissSign (Bronze)http://swisssign.net/IGTF
e9d08b40Switzerland - SwissSign (Silver)http://swisssign.net/IGTF
eebc7717SWITCH-Server-2007http://swisssign.net/IGTF
f2e89fe3USA - NCSA SLCShttp://security.ncsa.uiuc.edu/CA/IGTF
f5ead794PK-Grid-2007http://www.ncp.edu.pk/pk-grid-ca/IGTF
fe102e03Germany - DFN-GridGermany-Serverhttp://www.pca.dfn.de/IGTF
ff94d436Croatia - SRCEhttp://ra.srce.hr/IGTF