Requesting GSI Certificates

Before requesting a host / service / user GSI ceritificate, you must first run the $VDT_LOCATION/vdt/setup/setup-cert-request which is a replacement of the Globus's setup-gsi script.

> $VDT_LOCATION/vdt/setup/setup-cert-request

This will:

• Potentially prompt you to select a CA that you wich to use for your certificate request(s). Note: You are not prompted unless there is more than one grid-security.conf.* file installed in your certificates directory. By default, new versions of the VDT come with only one of these files, the one for the DOEGrids CA, so you will not be prompted. If you would like other CA's to be listed, let us know.
• Setup all necessary cert. request-related configuration files for that CA in the $VDT_LOCATION/globus/etc/ directory
• Setup a symlink from $VDT_LOCATION/globus/bin/grid-cert-request to one of the CA-specific grid-cert-request binaries. This is necessary because some CA's have different grid-cert-request implementations.

You may then run $VDT_LOCATION/globus/bin/grid-cert-request to request the actual certificate. Host certificates generally required a -host "FQDN" option; use grid-cert-request -help for more info.

You must repeat this whole procedure whenever you use a different CA for subsequent requests.

See also:

• Requesting DOEGrids certificates (This is targetted at OSG users, but is useful for anyone who wants a DOEGrid certificate.)
• DOEGrids Certificate Service
• Globus GSI Documentation for more details on configuration related to GSI certificate requests.