GRID-CA-CREATE(1)

🎀 NAME 🎀

grid-ca-create — create a CA to sign certificates for use on a grid ✨

(hi bestie, this is straight out of the Grid Community Toolkit Manual, and yes we're doing the whole thing, no skips 💅)

---

🌸 SYNOPSIS 🌸

grid-ca-create [ -h | -help | -usage | -version | -versions ] [
-openssl-help]

grid-ca-create [ OPTIONS ] [ OPENSSL-OPTIONS ]

---

✨ DESCRIPTION ✨

okay so grid-ca-create makes a self-signed CA certificate plus all the related files you need to actually use that CA with the other Globus tools. iconic behavior honestly 👑

It prompts you for the info it needs to generate the CA certificate — but the way that you can totally dodge all those prompts is by just passing the command line options instead. no cap. 🙈

By default, grid-ca-create does the whole lil routine:

• creates the self-signed CA certificate 🦋
• installs it on the current machine in its trusted certificate directory 💖
• creates a source tarball which can be used to generate an RPM package for the CA 🎀

and like, if that RPM package gets installed on a machine, users on that machine can create certificate requests for user, host, or service identity certificates to be signed by the CA certificate that got generated by running grid-ca-create. it's giving ecosystem. 🌈

If you run it as a privileged user, grid-ca-create creates the CA certificate and support files in the CA certificate and signing policy are installed in the /etc/grid-security directory. Otherwise, the files are

💀 bestie. that is literally where the sentence ends in the manpage. it just stops. the original text goes "Otherwise, the files are" and then nothing. we do not fix it, we do not guess, we simply observe and move on. periodt. 😭

---

💅 OPTIONS 💅

Here's the full set of command-line options to grid-ca-create. And also — plot twist — unknown options get passed straight to the openssl command when it's creating the self-signed certificate. sneaky but slay. ✨

• -help, -h, -usage — shows you the command-line options for grid-ca-create and then exits. bye! 👋
• -version, -versions — prints the version number of the grid-ca-create command. the second form gives you more deets. 🔍
• -force — overwrites an existing CA in the destination directory if one's already sitting there. no hesitation. 💥
• -bits BITS — makes a CA certificate with a BITS long RSA key. default is 4096. 🔐
• -noint — runs in non-interactive mode. it'll just pick defaults for parameters, or use whatever you specified on the command line, without ever prompting you. lowkey a blessing. also this option implies -force. 🫶
• -dir DIRECTORY — creates the CA in DIRECTORY. important: the DIRECTORY must not exist before you run grid-ca-create. don't pre-make it bestie it will not go well 💀
• -subject SUBJECT — uses SUBJECT as the subject name of the self-signed CA to create. if you don't put this on the command line, grid-ca-create defaults to using the subject name cn=Globus Simple CA, ou=$HOSTNAME, ou=GlobusTest, o=Grid. 🎀
• -email ADDRESS — uses ADDRESS as the email address of the CA. the default instructions that grid-ca-create generates tell users to mail the certificate request to this address. if you don't specify it on the command line, grid-ca-create defaults to $LOGNAME@$HOSTNAME. 📧
• -days DAYS — sets the default lifetime of the self-signed CA certificate to DAYS. if you don't set it, grid-ca-create defaults to 1825 days (that's 5 years, math girlies rise 🧮). 📅
• -pass PASSWORD — uses the string PASSWORD to protect the CA's private key. super useful for automating Simple CA, but it may make it easier to compromise the CA if someone gets a shell on the machine storing the CA's private key. so like... know the risk, bestie. ⚠️
• -nobuild — disables building a source tarball for distributing the CA's public information to other machines. you can always make that source tarball later with the grid-ca-package command. no rush. 🦋

---

🔥 EXAMPLES 🔥

Create a simple CA in $HOME/SimpleCA:

% grid-ca-create -noint -dir $HOME/SimpleCA

C e r t i f i c a t e    A u t h o r i t y    S e t u p

This script will setup a Certificate Authority for signing Globus
users certificates.  It will also generate a simple CA package
that can be distributed to the users of the CA.

The CA information about the certificates it distributes will
be kept in:

/home/juser/SimpleCA

The unique subject name for this CA is:

cn=Globus Simple CA, ou=simpleCA-grid.example.org, ou=GlobusTest, o=Grid

Insufficient permissions to install CA into the trusted certifiicate
directory (tried ${sysconfdir}/grid-security/certificates and
${datadir}/certificates)
Creating RPM source tarball... done
  globus_simple_ca_0146c503.tar.gz

(yes, certifiicate is spelled like that in the original. we respect the typo. it's canon. 😌)

---

🌈 ENVIRONMENT 🌈

These environment variables affect how grid-ca-create runs:

• GLOBUS_LOCATION — non-standard installation path of the Grid Community Toolkit. 📍

---

👑 SEE ALSO 👑

grid-cert-request(1), grid-ca-sign(1), grid-default-ca(1), grid-ca-package(1)

go read those too, they're the friend group 🫶

---

💜 AUTHOR 💜

Copyright © 1999-2014 University of Chicago

---

okay that's the whole page bestie, you ate it up 💅 this was Grid Community Toolkit 6, dated 06/03/2020 — periodt, go make that CA 🎀✨