====== GROW Certificates ======
===== GROW Certificate Information =====
 Here is a list of the certificates that we use here at GROW.
==== grow-grid.its.uiowa.edu ====
^  File Name  ^  Location  ^  Permissions  ^  Owner  ^
|  hostcert.pem  |  /etc/grid-locations  |  444  |  root:root  |
|  hostkey.pem  |  /etc/grid-locations  |  400  |  root:root  |
|  containercert.pem  |  /etc/grid-locations  |  444  |  daemon:daemon  |
|  containerkey.pem  |  /etc/grid-locations  |  400  |  daemon:daemon  |
|  rsvrcert.pem  |  /etc/grid-locations/rsv  |  444  |  rsv:users  |
|  rsvkey.pem  |  /etc/grid-locations/rsv  |  400  |  rsv:users  |
|  httpcert.pem  |  /etc/grid-locations/http  |  444  |  tomcat:daemon  |
|  httpkey.pem  |  /etc/grid-locations/http  |  400  |  tomcat:daemon  |
|  bestmancert.pem  |  /etc/grid-locations/bestman  |  444  |  bestman:root  |
|  bestmankey.pem  |  /etc/grid-locations/bestman  |  400  |  bestman:root  |

==== dynes-fdt.physics.uiowa.edu ====
^  File Name  ^  Location  ^  Permissions  ^  Owner  ^
|  dynes-fdt.physics.uiowa.educert.pem  |  /home/admin  |  444  |  admin:admin  |
|  dynes-fdt.physics.uiowa.edukey.pem  |  /home/admin  |  400  |  admin:admin  |

==== dynes-idc.net.uiowa.edu ====
^  File Name  ^  Location  ^  Permissions  ^  Owner  ^
|  dynes-idc.net.uiowa.educert.pem  | /home/admin  |  444  |  admin:admin  |
|  dynes-idc.net.uiowa.edukey.pem  |  /home/admin  |  400  |  admin:admin  |

<note warning>The Certificate Scripts Package must be installed in order to install certificates! Check [[https://www.opensciencegrid.org/bin/view/Documentation/Release3/GetHostServiceCertificates#Requirements|here]] for requirements before continuing.</note>
===== Requesting Certificates =====
[[https://twiki.grid.iu.edu/bin/view/ReleaseDocumentation/GetHostServiceCertificates|Here]] are the official instructions to retrieve host certificates.
The  cert-request script will prompt you for for:
  * Reason for request
  * Administrators name
  * Full hostname of server
  * Administrators email
  * Phone number
  * Choose a registration authority (Choose OSG)
  * Choose a VO (Choose CMS or OSG)
  * Confirms that you are authorized to install the certificate on the host.
If the script runs without error, you will then be given a certificate request id which can be used to identify the response email to a particular certificate request. You will also have two files in your current directory (where hostname is replaced with the hostname you supplied to the script):
  * hostnamekey.pem
  * hostname.req

Now you must wait for a response from DOEGrids which will contain a serial code needed to retrieve the certificate.

<note>Certificate renewal is the same process as requesting a new certificate.</note>
===== View Certificate Information =====
<note>Be sure to change "hostcert.pem" to the name and location of the certificate you wish to work with.</note>
==== openssl method ====
You can view the expiration of certificates by running this command.
<xterm2>
[user@grow-grid grid-security]# openssl x509 -in /etc/grid-security/hostcert.pem -subject -issuer -dates -noout
<fc #008000>subject= /DC=org/DC=doegrids/OU=Services/CN=grow-grid.its.uiowa.edu
issuer= /DC=org/DC=DOEGrids/OU=Certificate Authorities/CN=DOEGrids CA 1
notBefore=Jul 14 14:57:09 2011 GMT
notAfter=Jul 13 14:57:09 2012 GMT</fc>
</xterm2>


==== grid-cert-info method ====
<note>This method requires the Certificate Scripts Package to be installed </note>
<xterm2>
[user@grow-grid grid-security]# grid-cert-info -file ./hostcert.pem
</xterm2>
====== Host Certificate ======
===== Request Host =====
Submit a request for a host certificate. 
<xterm2 root>
[root@grow-grid grid-security]# cert-request -ou s -dir . -label grow-grid.its.uiowa.edu
</xterm2>
===== Retrieve Host =====
Once you have a reply from DOEGrids with a serial number in 0xYYYY format you can retrieve the certificate by running this command.
<xterm2 root>
[root@grow-grid grid-security]# cert-retrieve  -serial <fc #FF0000>0xYYYY</fc> -label <fc #FF0000>grow-grid.its.uiowa.edu</fc> -dir . -prefix <fc #FF0000>grow-grid.its.uiowa.edu</fc>
<fc #008000>%%
checking CertLib version, V2-7,  This is the latest version, released 18 May 2009.
 using CA doegrids
Using URL https://pki1.doegrids.org/displayBySerial?op=displayBySerial&serialNumber=0xYYYY 
Checking that the certificate and ./grow-grid.its.uiowa.edukey.pem match
writing RSA key
./grow-grid.its.uiowa.educert.pem and ./grow-grid.its.uiowa.edukey.pem now contain your new credential
%%</fc>
</xterm2>
===== Verify Host =====
Check to make sure the certificate matches your machine hostname.
<xterm2 root>
[root@grow-grid grid-security]# grid-cert-info -file ./<fc #FF0000>grow-grid.its.uiowa.educert.pem</fc> -subject
<fc #008000>/DC=org/DC=doegrids/OU=Services/CN=rsv/grow-grid.its.uiowa.edu</fc>
</xterm2>

Now execute:
<xterm2 root>
[root@grow-grid grid-security]# hostname -f
<fc #008000>grow-grid.its.uiowa.edu</fc>
</xterm2>
===== Edit Host =====
Change the certificate and key names to hostcert.pem and hostkey.pem and edit the file permissions.
<xterm2 root>
[root@grow-grid ~]# mv /etc/grid-security/<fc #FF0000>grow-grid.its.uiowa.educert.pem</fc> /etc/grid-security/<fc #00FFFF>hostcert.pem</fc>
[root@grow-grid ~]# chmod 444 /etc/grid-security/hostcert.pem
[root@grow-grid ~]# mv /etc/grid-security/<fc #FF0000>grow-grid.its.uiowa.edukey.pem</fc> /etc/grid-security/<fc #00FFFF>hostkey.pem</fc>
[root@grow-grid ~]# chmod 400 /etc/grid-security/hostkey.pem
</xterm2>
====== Container Certificate ======
We will use the host certificate as the container certificate. This is the only instance where using a copy of the host certificate is allowed.
<xterm2 root>
[root@grid-0-0 ~]# cp /etc/grid-security/grow-grid.its.uiowa.educert.pem /etc/grid-security/containercert.pem
[root@grid-0-0 ~]# cp /etc/grid-security/grow-grid.its.uiowa.edukey.pem /etc/grid-security/containerkey.pem
</xterm2>

Change ownership on the container certificate.
<xterm2 root>
[root@grid-0-0 ~]# chown daemon:daemon /etc/grid-security/containercert.pem
[root@grid-0-0 ~]# chown daemon:daemon /etc/grid-security/containerkey.pem
</xterm2>
====== HTTP Service Certificate ======
===== Request HTTP =====
<xterm2 root>
[root@grow-grid grid-security]# cert-request -ou s -service http -host grow-grid.its.uiowa.edu -dir . -label grow-grid.its.uiowa.edu-http
</xterm2>

===== Retrieve HTTP =====
<xterm2 root>
[root@grow-grid grid-security]# cert-retrieve  -serial <fc #FF0000>0xYYYYY</fc> -label <fc #FF0000>grow-grid.its.uiowa.edu-http</fc> -dir . -prefix <fc #FF0000>grow-grid.its.uiowa.edu-http</fc>
<fc #008000>checking CertLib version, V2-7,  This is the latest version, released 18 May 2009.
 using CA doegrids
Using URL https://pki1.doegrids.org/displayBySerial?op=displayBySerial&serialNumber=0x11526
Checking that the certificate and ./grow-grid.its.uiowa.edu-httpkey.pem match
writing RSA key
 previous ./grow-grid.its.uiowa.edu-httpkey.pem exists
previous ./grow-grid.its.uiowa.edu-httpkey.pem exists, overwrite? (N,y): y
mv: `./grow-grid.its.uiowa.edu-httpkey.pem' and `./grow-grid.its.uiowa.edu-httpkey.pem' are the same file
./grow-grid.its.uiowa.edu-httpcert.pem and ./grow-grid.its.uiowa.edu-httpkey.pem now contain your new credential</fc>
</xterm2>
===== Verifiy HTTP =====
Check to make sure the certificate matches your machine hostname.
<xterm2 root>
[root@grow-grid grid-security]# grid-cert-info -file ./grow-grid.its.uiowa.edu-httpcert.pem -subject
<fc #008000>/DC=org/DC=doegrids/OU=Services/CN=http/</fc><fc #FF0000>grow-grid.its.uiowa.edu</fc>
</xterm2>

Now execute:
<xterm2 root>
[root@grow-grid grid-security]# hostname -f
<fc #FF0000>grow-grid.its.uiowa.edu</fc>
</xterm2>
The host names in red above should match.
===== Edit HTTP =====
Change the certificate and key names to httpcert.pem and httpkey.pem and edit the file permissions and ownerships.
<xterm2 root>
[root@grow-grid ~]# mv /etc/grid-security/<fc #FF0000>grow-grid.its.uiowa.edu-httpcert.pem</fc> /etc/grid-security/http/<fc #00FFFF>httpcert.pem</fc>
[root@grow-grid ~]# chmod 444 /etc/grid-security/http/httpcert.pem
[root@grow-grid ~]# mv /etc/grid-security/<fc #FF0000>grow-grid.its.uiowa.edu-httpkey.pem</fc> /etc/grid-security/<fc #00FFFF>http/httpkey.pem</fc>
[root@grow-grid ~]# chmod 400 /etc/grid-security/http/httpkey.pem
[root@grow-grid ~]# chown tomcat:daemon /etc/grid-security/http/http*
</xterm2>
====== RSV Service Certificate ======
===== Request RSV =====
<xterm2 root>
[root@grow-grid grid-security]# cert-request -ou s -service rsv -host grow-grid.its.uiowa.edu -dir . -label grow-grid.its.uiowa.edu-rsv
</xterm2>
===== Retrieve RSV =====
Once you have a reply from DOEGrids with a serial number in 0xYYYY format you can retrieve the certificate by running this command.
<xterm2 root>
[root@grow-grid grid-security]# cert-retrieve  -serial <fc #FF0000>0xYYYY</fc> -label <fc #FF0000>grow-grid.its.uiowa.edu-rsv</fc> -dir . -prefix <fc #FF0000>grow-grid.its.uiowa.edu-rsv</fc>
<fc #008000>%%checking CertLib version, V2-7,  This is the latest version, released 18 May 2009.
 using CA doegrids
Using URL https://pki1.doegrids.org/displayBySerial?op=displayBySerial&serialNumber=0x11507
Checking that the certificate and ./grow-grid.its.uiowa.edu-rsvkey.pem match
writing RSA key
 previous ./grow-grid.its.uiowa.edu-rsvkey.pem exists
previous ./grow-grid.its.uiowa.edu-rsvkey.pem exists, overwrite? (N,y): y
mv: `./grow-grid.its.uiowa.edu-rsvkey.pem' and `./grow-grid.its.uiowa.edu-rsvkey.pem' are the same file
./grow-grid.its.uiowa.edu-rsvcert.pem and ./grow-grid.its.uiowa.edu-rsvkey.pem now contain your new credential
%%</fc>
</xterm2>
===== Verify RSV =====
Check to make sure the certificate matches your machine hostname.
<xterm2 root>
[root@grow-grid grid-security]# grid-cert-info -file ./grow-grid.its.uiowa.edu-rsvcert.pem -subject
<fc #008000>/DC=org/DC=doegrids/OU=Services/CN=</fc><fc #FF0000>grow-grid.its.uiowa.edu</fc>
</xterm2>

Now execute:
<xterm2 root>
[root@grow-grid grid-security
<fc #FF0000>grow-grid.its.uiowa.edu</fc>
</xterm2>
The host names in red above should match.
===== Edit RSV =====
Change the certificate and key names to rsvcert.pem and rsvkey.pem, place them in /etc/grid-security/rsv, and edit the file ownership and permissions.
<xterm2 root>
[root@grow-grid ~]# mv /etc/grid-security/<fc #FF0000>grow-grid.its.uiowa.edu-rsvcert.pem</fc> /etc/grid-security/<fc #00FFFF>rsv/rsvcert.pem</fc>
[root@grow-grid ~]# mv /etc/grid-security/<fc #FF0000>grow-grid.its.uiowa.edu-rsvkey.pem</fc> /etc/grid-security/<fc #00FFFF>rsv/rsvkey.pem</fc>
[root@grow-grid ~]# chmod 444 /etc/grid-security/rsv/rsvcert.pem
[root@grow-grid ~]# chmod 400 /etc/grid-security/rsv/rsvkey.pem
[root@grow-grid grid-security]# chown rsv:root /etc/grid-security/rsv/rsvkey.pem
[root@grow-grid grid-security]# chown rsv:root /etc/grid-security/rsv/rsvcert.pem
</xterm2>
====== Bestman Service Certificate ======
The bestman service certificate will be used by the bestman user and stored at grow-grid.its.uiowa.edu:/etc/grid-security/bestman.
===== Request Bestman =====
<xterm2 root>
[root@grow-grid bestman]# cert-request -ou s -service bestman -host grow-grid.its.uiowa.edu -label bestman-grow-grid.its.uiowa.edu-bestman
</xterm2>
===== Retrieve Bestman =====
Once you have a confirmation, you can retrieve the certificate using the serial number sent in the confirmation email.
<xterm2 root>
[root@grow-grid grid-security]# cert-retrieve  -serial <fc #FF0000>0xYYYYY</fc> -label <fc #FF0000>grow-grid.its.uiowa.edu-bestman</fc> -dir . -prefix <fc #FF0000>grow-grid.its.uiowa.edu-bestman</fc>
</xterm2>
===== Verify Bestman =====
Check to make sure the certificate matches your machine hostname.
<xterm2 root>
[root@grow-grid grid-security]# grid-cert-info -file ./grow-grid.its.uiowa.edu-bestmancert.pem -subject
<fc #008000>/DC=org/DC=doegrids/OU=Services/CN=bestman/</fc><fc #FF0000>grow-grid.its.uiowa.edu</fc>
</xterm2>

Now execute:
<xterm2 root>
[root@grow-grid grid-security]# hostname -f
<fc #FF0000>grow-grid.its.uiowa.edu</fc>
</xterm2>
The host names in red above should match.
===== Edit Bestman =====
Move the certificate and key to the bestman directory and change the owner/permissions as such:
<xterm2 root>
[root@grow-grid grid-security]# mv <fc #FF0000>grow-grid.its.uiowa.edu-bestmancert.pem</fc> <fc #00FFFF>bestman/bestmancert.pem</fc>
[root@grow-grid grid-security]# mv <fc #FF0000>grow-grid.its.uiowa.edu-bestmankey.pem</fc> <fc #00FFFF>bestman/bestmankey.pem</fc>
[root@grow-grid grid-security]# chown bestman:root bestman/bestman*
[root@grow-grid bestman]# chmod 400 /etc/grid-security/bestman/bestmankey.pem 
[root@grow-grid bestman]# chmod 444 /etc/grid-security/bestman/bestmancert.pem
</xterm2>

====== DYNES FDT Host Certificate ======
Here is how to view the certificate information if it already exists:
<xterm2>
[admin@dynes-fdt ~]$ openssl x509 -in /home/admin/dynes-fdt.physics.uiowa.educert.pem -text -noout
</xterm2>
===== Request FDT Host =====
<note>I am using grow-grid to request certificates for the dynes equipment in hopes that I will not have to install OSG software on the DYNES equipment.</note>
Submit a request for a certificate.
<xterm2>
[user@grow-grid ~]# cert-request -ou s -dir . -label dynes-fdt.physics.uiowa.edu
</xterm2>
===== Retrieve FDT Host =====
Once you have a confirmation, you can retrieve the certificate using the serial number sent in the confirmation email.
<xterm2>
[dsquires@grow-grid ~]$ cert-retrieve  -serial <fc #FF0000>0xYYYYY</fc> -label <fc #FF0000>dynes-fdt.physics.uiowa.edu</fc> -dir . -prefix <fc #FF0000>dynes-fdt.physics.uiowa.edu</fc>
<fc #008000>%%checking CertLib version, V2-7,  This is the latest version, released 18 May 2009.
 using CA doegrids
Using URL https://pki1.doegrids.org/displayBySerial?op=displayBySerial&serialNumber=0x11508
Checking that the certificate and ./dynes-fdt.physics.uiowa.edukey.pem match
writing RSA key
 previous ./dynes-fdt.physics.uiowa.edukey.pem exists
previous ./dynes-fdt.physics.uiowa.edukey.pem exists, overwrite? (N,y): y
mv: `./dynes-fdt.physics.uiowa.edukey.pem' and `./dynes-fdt.physics.uiowa.edukey.pem' are the same file
./dynes-fdt.physics.uiowa.educert.pem and ./dynes-fdt.physics.uiowa.edukey.pem now contain your new credential
%%</fc>
</xterm2>

===== Verify FDT Host =====
Check to make sure the certificate matches your machine hostname.
<xterm2>
[user@grow-grid ~]$ grid-cert-info -file ./dynes-idc.net.uiowa.educert.pem -subject
<fc #008000>/DC=org/DC=doegrids/OU=Services/CN=</fc><fc #FF0000>dynes-fdt-physics.uiowa.edu</fc>
</xterm2>
Now execute:
<xterm2>
[admin@dynes-fdt ~]$ hostname -f
<fc #FF0000>dynes-fdt.physics.uiowa.edu</fc>
</xterm2>
The host names in red above should match.
===== Edit FDT Host =====
Move the certificate and key to the FDT server. These files will be kept in /home/admin.
<xterm2>
[dsquires@grow-grid ~]$ scp dynes-fdt.physics.uiowa.edu* admin@dynes-fdt.physics.uiowa.edu:/home/admin
<fc #008000>DYNES Authorized Use Only
dynes-fdt.physics.uiowa.educert.pem                                                            100% 1574     1.5KB/s   00:00    
dynes-fdt.physics.uiowa.edukey.pem                                                             100% 1675     1.6KB/s   00:00</fc> 
</xterm2>

Verify that the key and certificate are owned by admin:admin and that the permissions are 444 for dynes-fdt.physics.uiowa.educert.pem, and 400 for dynes-fdt.physics.uiowa.edukey.pem.
<xterm2>
[admin@dynes-fdt ~]$ ls -lh
<fc #008000>total 8.0K
-rw-r--r-- 1 admin admin 1.6K Jul  3 16:41 dynes-fdt.physics.uiowa.educert.pem
-rw------- 1 admin admin 1.7K Jul  3 16:41 dynes-fdt.physics.uiowa.edukey.pem</fc>
</xterm2>
====== DYNES IDC Host Certificate ======
Here is how to view the certificate information if it already exists:
<xterm2>
[admin@dynes-idc ~]$ openssl x509 -in /home/admin/dynes-idc-vm1.net.uiowa.educert.pem -text -noout
</xterm2>
===== Request IDC Host =====
<note>I am using grow-grid to request certificates for the dynes equipment in hopes that I will not have to install OSG software on the DYNES equipment.</note>

Request the certificate.
<xterm2>
[user@grow-grid ~]# cert-request -ou s -dir . -label dynes-idc.net.uiowa.edu
</xterm2>
===== Retrieve IDC Host =====
Once you have a confirmation, you can retrieve the certificate using the serial number sent in the confirmation email.
<xterm2>
[user@grow-grid ~]$ cert-retrieve  -serial 0xYYYYY -label <fc #FF0000>dynes-idc-vm1.net.uiowa.edu</fc> -dir . -prefix <fc #FF0000>dynes-idc-vm1.net.uiowa.edu</fc>
<fc #008000>%%checking CertLib version, V2-7,  This is the latest version, released 18 May 2009.
 using CA doegrids
Using URL https://pki1.doegrids.org/displayBySerial?op=displayBySerial&serialNumber=0x11509
Checking that the certificate and ./dynes-idc-vm1.net.uiowa.edukey.pem match
writing RSA key
 previous ./dynes-idc-vm1.net.uiowa.edukey.pem exists
previous ./dynes-idc-vm1.net.uiowa.edukey.pem exists, overwrite? (N,y): y
mv: `./dynes-idc-vm1.net.uiowa.edukey.pem' and `./dynes-idc-vm1.net.uiowa.edukey.pem' are the same file
./dynes-idc-vm1.net.uiowa.educert.pem and ./dynes-idc-vm1.net.uiowa.edukey.pem now contain your new credential
%%</fc>
</xterm2>
===== Verify IDC Host =====
Check to make sure the certificate matches your machine hostname.
<xterm2>
[user@grow-grid ~]$ grid-cert-info -file ./dynes-idc.net.uiowa.educert.pem -subject
<fc #008000>/DC=org/DC=doegrids/OU=Services/CN=</fc><fc #FF0000>dynes-idc-vm1.net.uiowa.edu</fc>
</xterm2>

Now execute this command on the IDC server:
<xterm2>
[admin@dynes-idc ~]$ hostname -f
<fc #FF0000>dynes-idc-vm1.net.uiowa.edu</fc>
</xterm2>
The host names in red above should match.
===== Edit IDC Host =====
Move the certificate and key to the IDC server. These files will be kept in /home/admin.
<xterm2>
[user@grow-grid ~]$ scp dynes-idc-vm1.net.uiowa.edu* admin@dynes-idc.net.uiowa.edu:/home/admin
<fc #008000>DYNES Authorized Use Only
dynes-idc-vm1.net.uiowa.educert.pem                                                                100% 1562     1.5KB/s   00:00    
dynes-idc-vm1.net.uiowa.edukey.pem                                                                 100% 1675     1.6KB/s   00:00</fc> 
</xterm2>

Verify that the key and certificate are owned by admin:admin and that the permissions are 444 for dynes-idc-vm1.net.uiowa.educert.pem, and 400 for dynes-idc-vm1.net.uiowa.edukey.pem.
<xterm2>
[admin@dynes-idc ~]$ ls -lh
<fc #008000>total 8.0K
-rw-r--r-- 1 admin admin 1.6K Jul  3 15:37 dynes-idc-vm1.net.uiowa.educert.pem
-rw------- 1 admin admin 1.7K Jul  3 15:37 dynes-idc-vm1.net.uiowa.edukey.pem</fc>
</xterm2>
====== Notes ======


====== Contact Info ======
This Dokuwiki page is maintained by:\\
Daniel Squires\\
University of Iowa\\
Department of Computer Science\\
Email: <daniel-squires@uiowa.edu>