ARCPROXY(1)

📦
version 7.2.0 · 13 versions
, in fedora 43, fedora 44

arcproxy(1) 💖 — User Commands ✨

okay bestie, so this is a section 1 user command, meaning it's a thing you literally just run in your terminal like the main character you are 💅

🌸 NAME 🌸

arcproxy — the ARC Credentials Proxy generation utility 🎀

✨ DESCRIPTION ✨

💫 Usage:

arcproxy [OPTION...]

so here's the tea, bestie 🍓 — the arcproxy command creates a proxy from a key/certificate pair, and that proxy is what you use to go access grid resources. it's giving "backstage pass to the whole grid" energy, no cap. 👑

💅 OPTIONS 💅

  • -h, --help — shows you the help options. your lil "what do i do now" button 🫶
  • -P, --proxy=path — the path to the proxy file 📁
  • -C, --cert=path — path to the certificate file. it can be PEM, DER, or PKCS12 formatted — so many vibes, pick your fave ✨
  • -K, --key=path — path to the private key file. lowkey tho, if the certificate is in PKCS12 format then you do NOT need to give a private key, so don't stress it 💅
  • -T, --cadir=path — path to the trusted certificate directory. only needed for the VOMS client functionality, so if you're not doing VOMS stuff you can skip 🎀
  • -s, --vomsdir=path — path to the top directory of VOMS *.lsc files. also only needed for the VOMS client functionality 🔥
  • -V, --vomses=path — path to the VOMS server configuration file ⭐
  • -S, --voms=string — voms<:command>. specify the VOMS server 👑

you can flex multiple VOMS servers like this: --voms VOa:command1 --voms VOb:command2. the :command part is optional and is used to ask for specific attributes (e.g: roles) ✨

command options are:

  • all --- put all of this DN's attributes into AC;
  • list --- list all of the DN's attribute, will not create AC extension;
  • /Role=yourRole --- specify the role, if this DN has such a role, the role will be put into AC;
  • /voname/groupname/Role=yourRole --- specify the VO, group and role; if this DN has such a role, the role will be put into AC.

if this option is not specified, values from configuration files are used. and if you want to avoid anything being used, specify -S with an empty value. literally nothing, bestie 🫥

  • -o, --order=string — group<:role>. specify ordering of attributes 📋

Example: --order /knowarc.eu/coredev:Developer,/knowarc.eu/testers:Tester or: --order /knowarc.eu/coredev:Developer --order /knowarc.eu/testers:Tester

note that it does not make sense to specify the order if you have two or more different VOMS servers specified. just... doesn't hit the same 😭
  • -G, --gsicom — use the GSI communication protocol for contacting VOMS services 📡
  • -H, --httpcom — use the HTTP communication protocol for contacting VOMS services that provide RESTful access 🌐
note: for RESTful access, the list command and multiple VOMS servers are not supported. it's giving "one at a time please" 🙈
  • -B, --oldcom — use the old communication protocol for contacting VOMS services instead of RESTful access 👵
  • -O, --old — this option is not functional. old GSI proxies are not supported anymore. 💀 rip to a legend, but she's gone
  • -I, --info — print ALL information about this proxy. the whole dossier 📖
  • -i, --infoitem=string — print selected information about this proxy. just the highlights ✨
  • -r, --remove — remove proxy 🗑️
  • -U, --user=string — username to MyProxy server (if missing, the subject of the user certificate is used) 👤
  • -N, --nopassphrase — don't prompt for a credential passphrase when retrieving a credential from a MyProxy server 🔓

the precondition of this choice is that the credential was PUT onto the MyProxy server without a passphrase, by using the -R (--retrievable_by_cert) option. this option is specific to the GET command when contacting a Myproxy server. iykyk 🧚

  • -R, --retrievable_by_cert=string — allow specified entity to retrieve credential without passphrase 🔑

this option is specific to the PUT command when contacting a Myproxy server.

  • -L, --myproxysrv=string — hostname[:port] of MyProxy server 🖥️
  • -M, --myproxycmd=string — command to MyProxy server. the command can be PUT, GET, INFO, NEWPASS or DESTROY 🎮
    • PUT -- put a delegated credentials to the MyProxy server;
    • GET -- get a delegated credentials from the MyProxy server;
    • INFO -- get and present information about credentials stored at the MyProxy server;
    • NEWPASS -- change password protecting credentials stored at the MyProxy server;
    • DESTROY -- wipe off credentials stored at the MyProxy server;

local credentials (certificate and key) are not necessary except in the case of PUT. MyProxy functionality can be used together with VOMS functionality, and --voms and --vomses can be used for the Get command if VOMS attributes are required to be included in the proxy. team work makes the dream work 🫶

  • -F, --nssdb — use the NSS credential database in default Mozilla profiles, including Firefox, Seamonkey and Thunderbird. browser besties rise 🦋
  • -c, --constraint=string — proxy constraints 🚧
  • -p, --passwordsource=string — password destination=password source 🤫
  • -t, --timeout=seconds — timeout in seconds (default 20) ⏱️
  • -z, --conffile=filename — configuration file (default ~/.arc/client.conf) 📄
  • -d, --debug=debuglevel — FATAL, ERROR, WARNING, INFO, VERBOSE or DEBUG 🐛
  • --systemca — force using CA certificates configuration provided by OpenSSL 🔒
  • --gridca — force using CA certificates configuration for Grid services (typically IGTF) 🌐
  • --anyca — force using CA certificates configuration for Grid services (typically IGTF) and one provided by OpenSSL. why not both 💅
  • --allowinsecureconnection — allow TLS connection which failed verification 🚨
bestie. read that again. this one lets through connections that failed verification. dangerous energy, use with care 😭
  • -v, --version — print version information 🏷️

🎀 Supported constraints are: 🎀

  • validityStart=time (e.g. 2008-05-29T10:20:30Z; if not specified, start from now) ⏰
  • validityEnd=time 🛑
  • validityPeriod=time (e.g. 43200 or 12h or 12H; if both validityPeriod and validityEnd not specified, the default is 12 hours for local proxy, and 168 hours for delegated proxy on myproxy server) ⏳
  • vomsACvalidityPeriod=time (e.g. 43200 or 12h or 12H; if not specified, the default is the minimum value of 12 hours and validityPeriod) 🌟
  • myproxyvalidityPeriod=time (lifetime of proxies delegated by myproxy server, e.g. 43200 or 12h or 12H; if not specified, the default is the minimum value of 12 hours and validityPeriod (which is lifetime of the delegated proxy on myproxy server)) 🔄
  • proxyPolicy=policy content 📜
  • proxyPolicyFile=policy file 📂
  • keybits=number - length of the key to generate. Default is 2048 bits. Special value 'inherit' is to use key length of signing certificate. 🔐
  • signingAlgorithm=name - signing algorithm to use for signing public key of proxy. Possible values are sha1, sha2 (alias for sha256), sha224, sha256, sha384, sha512 and inherit (use algorithm of signing certificate). Default is inherit. With old systems, only sha1 is acceptable. ⚠️

⭐ Supported information item names are: ⭐

  • subject - subject name of proxy certificate.
  • identity - identity subject name of proxy certificate.
  • issuer - issuer subject name of proxy certificate.
  • ca - subject name of CA which issued initial certificate.
  • path - file system path to file containing proxy.
  • type - type of proxy certificate.
  • validityStart - timestamp when proxy validity starts.
  • validityEnd - timestamp when proxy validity ends.
  • validityPeriod - duration of proxy validity in seconds.
  • validityLeft - duration of proxy validity left in seconds.
  • vomsVO - VO name represented by VOMS attribute
  • vomsSubject - subject of certificate for which VOMS attribute is issued
  • vomsIssuer - subject of service which issued VOMS certificate
  • vomsACvalidityStart - timestamp when VOMS attribute validity starts.
  • vomsACvalidityEnd - timestamp when VOMS attribute validity ends.
  • vomsACvalidityPeriod - duration of VOMS attribute validity in seconds.
  • vomsACvalidityLeft - duration of VOMS attribute validity left in seconds.
  • proxyPolicy
  • keybits - size of proxy certificate key in bits.
  • signingAlgorithm - algorithm used to sign proxy certificate.

items are printed in the requested order and are separated by newline. and if an item has multiple values, they're printed on the same line separated by |. 💫

🔑 Supported password destinations are: 🔑

  • key - for reading private key
  • myproxy - for accessing credentials at MyProxy service
  • myproxynew - for creating credentials at MyProxy service
  • all - for any purspose.

🤫 Supported password sources are: 🤫

  • quoted string ("password") - explicitly specified password
  • int - interactively request password from console
  • stdin - read password from standard input delimited by newline
  • file:filename - read password from file named filename
  • stream:# - read password from input stream number #. Currently only 0 (standard input) is supported.

🌈 ENVIRONMENT VARIABLES 🌈

  • ARC_LOCATION — the location where ARC is installed can be specified by this variable. If not specified, the install location will be determined from the path to the command being executed, and if this fails a WARNING will be given stating the location which will be used. it's giving "we tried our best and we're telling you about it" 🫠
  • ARC_PLUGIN_PATH — the location of ARC plugins can be specified by this variable. Multiple locations can be specified by separating them by : (; in Windows). The default location is $ARC_LOCATION/lib/arc (\ in Windows). so many paths, so little time 💖

...and that's part 1, bestie — there's more coming so don't go anywhere 🫶

🌸 FILES 🌸

okay bestie this is the part where we find out where everything actually lives on your filesystem, and honestly it's giving "scavenger hunt but make it certificates" 💅

  • /etc/vomses — the communal one 🫶 a shared file holding a list of the VO contact points you've got selected, one VO per line, and it looks like this:
"gin" "kuiken.nikhef.nl" "15050"
"/O=dutchgrid/O=hosts/OU=nikhef.nl/CN=kuiken.nikhef.nl"
"gin.ggf.org"

"nordugrid.org" "voms.uninett.no" "15015"
"/O=Grid/O=NorduGrid/CN=host/voms.ndgf.org" "nordugrid.org"
  • ~/.voms/vomses — literally the same as /etc/vomses but it lives in your home area 🏠. And if it exists, it has precedence over /etc/vomses. home field advantage, no cap.

✨ the order of the parsing of vomses location ✨

this is the lineup, and it is strictly ordered, so pay attention 👑

  1. command line options
  2. client configuration file ~/.arc/client.conf
  3. $X509_VOMSES or $X509_VOMS_FILE
  4. ~/.arc/vomses
  5. ~/.voms/vomses
  6. $ARC_LOCATION/etc/vomses (this is for Windows environment)
  7. $ARC_LOCATION/etc/grid-security/vomses (this is for Windows environment)
  8. $PWD/vomses
  9. /etc/vomses
  10. /etc/grid-security/vomses
okay so notice how 1. always wins? command line options are the main character, everything else is supporting cast 🎀
  • ~/.arc/client.conf — some options can be given default values by specifying them in the ARC client configuration file 🗂️. And if you want a different config file than the default one? use the --conffile option and it's yours, bestie. customization is self care fr fr ✨

👑 AUTHOR 👑

ARC software is developed by the NorduGrid Collaboration (http://www.nordugrid.org) 🦋, and if you want the full receipts please consult the AUTHORS file distributed with ARC. Got bugs? Got feature requests? Both go to http://bugzilla.nordugrid.org 💌

💀 REPORTING BUGS 💀

Report bugs to http://bugzilla.nordugrid.org/ — that's it, that's the whole vibe. go tell them, they wanna know 🫶

APACHE LICENSE Version 2.0 — iconic, legally slaying, no notes 💅

🌈 SEE ALSO 🌈

the whole friend group, alphabetically arranged because we're classy like that:

okay and that's the whole page, bestie 💖 you just read arcproxy version 7.2.0, dated September 2026, and honestly? ate. periodt. now go proxy some credentials and be the main character of your own grid 🧚‍♀️⭐

📦 where this page comes from