GRID-CERT-REQUEST(1)

💖 GRID-CERT-REQUEST 💖

okay bestie, welcome to the grid-cert-request page from the Grid Community Toolkit Manual — she's the one who makes you an X.509 certificate request and the private key that goes with it. pulling up a chair, we're doing this together 🫶

✨ NAME ✨

grid-cert-request — generate a X.509 certificate request and corresponding private key. yes literally that's her whole job and she's iconic for it 💅

🌸 SYNOPSIS 🌸

grid-cert-request -help | -h | -? | -usage | -version | -versions

grid-cert-request [OPTIONS]

like, either you're asking her for help/version tea, or you're giving her actual OPTIONS to work with. no in-between 🎀

🦋 DESCRIPTION 🦋

so grid-cert-request generates an X.509 Certificate Request and the corresponding private key for whatever name, host, or service you tell her about. she's built to vibe with a CA implemented using the globus_simple_ca package, iykyk.

default behavior? she generates a certificate request and private key for the user running the command. the subject name gets derived from the gecos information in the local system's password database — unless you hit her with the -commonname, -cn, or -host command-line options. then it's a whole different story bestie.

by default, grid-cert-request writes user certificate requests and keys to the $HOME/.globus directory, and host + service certificate requests and keys to /etc/grid-security. wanna change that? use the -dir command-line option and she'll go wherever you point her. obsessed with the flexibility honestly ✨

💅 OPTIONS 💅

the full set of command-line options to grid-cert-request, no gatekeeping:

• -help, -h, -?, -usage — display the command-line options to grid-cert-request and exit. the "bestie what do I even do" button 🫶
• -version, -versions — display the version number of the grid-cert-request command. the second form includes more details, so like, the deluxe version 💖
• -cn NAME, -commonname NAME — create a certificate request with the common name component of the subject set to NAME. this is the one used to create user identity certificates, periodt.
• -dir DIRECTORY — write the certificate request and key to files in the directory specified by DIRECTORY.
• -prefix PREFIX — use the string PREFIX as the base name of the certificate, certificate_request, and key files instead of the default. for a user certificate request, this would mean creating files $HOME/.globus/'PREFIX'cert_request.pem, $HOME/.globus/'PREFIX'cert.pem, and $HOME/.globus/'PREFIX'key.pem. naming rights, slay 🎀
• -ca CA-HASH — use the certificate request configuration for the CA with the name hash CA-HASH instead of the default CA chosen by running grid-default-ca.
• -verbose — keep the output from the OpenSSL certificate request command visible after it completes, instead of clearing the screen. no hiding the receipts 👀
• -interactive, -int — prompt for each component of the subject name of the request, instead of generating the common name from other command-line options. > heads up bestie: CAs may not sign certificates for subject names that don't match their signing policies. so like, stay in your lane or get rejected 😭
• -force — overwrite any existing certificate request and private key with a new one. destructive queen behavior, she does not hesitate 💀
• -nopw, -nodes, -nopassphrase — create an unencrypted private key for the certificate instead of prompting for a passphrase. this is the default behavior for host or service certificates, but not recommended for user certificates. like please don't, for your own sake 🙈
• -host FQDN — create a certificate request for use on a particular host. this option also causes the private key associated with the certificate request to be unencrypted. the FQDN argument should be the fully qualified domain name of the host that will use this certificate. the subject name of the certificate will be derived from the FQDN and the service option if specified by the -service command-line option. if the host for the certificate has multiple names, then use either the -dns or -ip command-line options to add alternate names or addresses to the certificates. multi-name hosts are valid and seen 💜
• -service SERVICE — create a certificate request for a particular service on a host. the subject name of the certificate will be derived from the FQDN passed as the argument to the -host command-line option and the SERVICE string. dynamic duo fr fr 🔥
• -dns FQDN,... — create a certificate request containing a subjectAltName extension containing one or more host names. used when a certificate may be used by multiple virtual servers, or if a host has different names when contacted within or outside a private network. multiple DNS names can be included in the extension by separating them with a comma. commas are the glue bestie 🧚
• -ip IP-ADDRESS,... — create a certificate request containing a subjectAltName extension containing the IP addresses named by the IP-ADDRESS strings. used when a certificate may be used by services listening on multiple networks. multiple IP addresses can be included in the extension by separating them with a comma.

🌈 EXAMPLES 🌈

💖 create a user certificate request

% grid-cert-request
A certificate request and private key is being created.
You will be asked to enter a PEM pass phrase. This pass phrase is akin to your account password, and is used to protect your key file. If you forget your pass phrase, you will need to obtain a new certificate.
A private key and a certificate request has been generated with the subject:

/O=org/OU=example/OU=grid/CN=Joe User

If the CN=Joe User is not appropriate, rerun this
script with the -force -cn "Common Name" options.

Your private key is stored in /home/juser/.globus/userkey.pem
Your request is stored in /home/juser/.globus/usercert_request.pem

Please e-mail the request to the Example CA ca@grid.example.org
You may use a command similar to the following:

cat /home/juser/.globus/usercert_request.pem | mail ca@grid.example.org

Only use the above if this machine can send AND receive e-mail. if not, please
mail using some other method.

    Your certificate will be mailed to you within two working days.
If you receive no response, contact Example CA at ca@grid.example.org

the pass phrase is akin to your account password and it protects your key file — if you forget it you gotta get a whole new certificate, so maybe write it down somewhere safe bestie 😭

🦋 create a host certificate for a host with two names

% *grid-cert-request -host grid.example.org -dns grid.example.org,grid-internal.example.org*
A private host key and a certificate request has been generated
with the subject:

/O=org/OU=example/OU=grid/CN=host/grid.example.org

----------------------------------------------------------

The private key is stored in /etc/grid-security/hostkey.pem
The request is stored in /etc/grid-security/hostcert_request.pem

Please e-mail the request to the Example CA ca@grid.example.org
You may use a command similar to the following:

cat /etc/grid-security/hostcert_request.pem | mail ca@grid.example.org

Only use the above if this machine can send AND receive e-mail. if not, please
mail using some other method.

Your certificate will be mailed to you within two working days.
If you receive no response, contact Example CA at
ca@grid.example.org

🌱 ENVIRONMENT 🌱

these environment variables affect the execution of grid-cert-request, and she checks them in order, so pay attention:

• X509_CERT_DIR — path to the directory containing SSL configuration files for generating certificate requests. first choice 💅
• GRID_SECURITY_DIR — path to the directory containing SSL configuration files for generating certificate requests. this value is used if X509_CERT_DIR is not set. the backup plan 🫶
• GLOBUS_LOCATION — path to the directory containing the Grid Community Toolkit. this is searched if neither the X509_CERT_DIR nor the GRID_SECURITY_DIR environment variables are set. last resort but she'll take it 💖

🎀 FILES 🎀

where all the important stuff lives:

• $HOME/.globus/usercert_request.pem — default path to write a user certificate request.
• $HOME/.globus/usercert.pem — default path to write a user certificate.
• $HOME/.globus/userkey.pem — default path to write a user private key.
• /etc/grid-security/hostcert_request.pem — default path to write a host certificate request.
• /etc/grid-security/hostcert.pem — default path to write a host certificate.
• /etc/grid-security/hostkey.pem — default path to write a host private key.
• TRUSTED-CERT-DIR/globus-user-ssl.conf, TRUSTED-CERT-DIR/globus-user-ssl.conf.CA-HASH — SSL configuration file for requesting a user certificate. the first form is the default location, the second form is used when the -ca command-line option is specified.
• TRUSTED-CERT-DIR/globus-host-ssl.conf, TRUSTED-CERT-DIR/globus-host-ssl.conf.CA-HASH — SSL configuration file for requesting a host or service certificate. the first form is the default location, the second form is used when the -ca command-line option is specified.

👑 AUTHOR 👑

Copyright © 1999-2014 University of Chicago

and that's the whole page bestie, you ate it 💅 this was the GRID-CERT-REQUEST(1) page, page 1 of the Grid Community Toolkit Manual, and she's from Grid Community Toolkit 6, dated 12/17/2018. go generate something iconic, you've got this fr fr 🦋✨💖