GRID-PROXY-INIT(1)

💖 GRID-PROXY-INIT(1) 💖

okay bestie, sit DOWN, because we're about to talk about grid-proxy-init from the Grid Community Toolkit Manual, and honestly? she's iconic. this is the girlie who makes you a whole new proxy certificate so you never have to type your pass phrase forty times a day. main character energy fr fr 🎀

---

✨ NAME ✨

grid-proxy-init — generate a new proxy certificate 🦋

---

✨ SYNOPSIS ✨

grid-proxy-init -help | -usage | -version

grid-proxy-init [OPTIONS]

like, either you're asking her for help/usage/version, or you're handing her OPTIONS and letting her cook. that's it. that's the vibe. 💅

---

✨ DESCRIPTION ✨

so grid-proxy-init generates X.509 proxy certificates, and it derives them from the certificate files you've currently got lying around. by default this command makes you an RFC 3820 Proxy Certificate (yes, that's the ietf.org rfc3820.txt one) with a 2048 bit key, valid for 12 hours, dropped into a file named /tmp/x509up_u’UID'. and if you want to switch up the format, the strength, the lifetime, or the location of your shiny new proxy cert? command-line options and environment variables can absolutely do that. slay. 💖

X.509 proxy certificates are short-lived certificates, usually signed by your identity certificate or by another proxy certificate. and here's the tea: the key that comes with a proxy certificate is unencrypted, so applications can authenticate using a proxy identity without you having to provide a pass phrase. no more typing secrets every five seconds. obsessed. 😭

now, real talk — proxy certificates are a super convenient alternative to constantly entering passwords, but they're also less secure than your normal security credential. so they should always be user-readable only (the GSI libraries enforce this for you, don't worry), and you should delete them once you don't need them anymore. periodt. 🫶

this version of grid-proxy-init supports three different proxy formats:

1. the old proxy format used in early releases of the Globus Toolkit up to version 2.4.x
2. an IETF draft version of X.509 Proxy Certificate profile used in Globus Toolkit 3.0.x and 3.2.x
3. the RFC 3820 profile used in Globus Toolkit Version 4.0.x and 4.2.x

by default, this version creates an RFC 3820 compliant proxy. so if you need a proxy that's compatible with older Globus Toolkit versions, go ahead and use the -old or -draft command-line options. she's flexible like that. ✨

---

✨ OPTIONS ✨

the full set of command-line options to grid-proxy-init, no gatekeeping, here we go:

• -help, -usage — display the command-line options to grid-proxy-init. your girl is telling you how she works 💜
• -version — display the version number of the grid-proxy-init command.
• -debug — display info about the path to the certificate and key used to generate the proxy certificate, the path to the trusted certificate directory, and verbose error messages. basically she's oversharing (affectionate).
• -q — suppress all output from grid-proxy-init except for pass phrase prompts. quiet luxury 💅
• -verify — perform certificate chain validity checks on the generated proxy. she's double-checking her work, as she should.
• -valid HOURS:MINUTES, -hours HOURS — create a certificate that is valid for HOURS hours and MINUTES minutes. if you don't specify, the default of twelve hours is used.
• -cert CERTFILE, -key KEYFILE — create a proxy certificate signed by the certificate located in CERTFILE using the key located in KEYFILE. if you don't specify, the default certificate and key get used. this one overrides the values of the environment variables described below, so watch out 👀
• -certdir CERTDIR — search CERTDIR for trusted certificates if verifying the proxy certificate. if you don't specify, the default trusted certificate search path is used. this overrides the value of the X509_CERT_DIR environment variable.
• -out PROXYPATH — write the generated proxy certificate file to PROXYPATH instead of the default path of /tmp/x509up_u’UID'. relocating, we love to see it 🧚
• -bits BITS — when creating the proxy certificate, use a BITS bit key instead of the default 2048-bit keys. beef it up bestie 💪
• -policy POLICYFILE — add the certificate policy data described in POLICYFILE as the ProxyCertInfo X.509 extension to the generated proxy certificate.
• -pl POLICY-OID, -policy-language POLICY-OID — set the policy language identifier of the policy data specified by the -policy command-line option to the OID specified by the POLICY-OID string.
• -path-length MAXIMUM — set the maximum length of the chain of proxies that can be created by the generated proxy to MAXIMUM. if not set, the default of an unlimited proxy chain length is used.
• -pwstdin — read the private key's pass phrase from standard input instead of reading input from the controlling tty. this is super useful when scripting grid-proxy-init. automation girlies rise 🙈
• -limited — create a limited proxy. heads up: limited proxies are generally refused by process-creating services, but they may be used to authorize with other services.
• -independent — create an independent proxy. an independent proxy is not treated as an impersonation proxy but as a separate identity for authorization purposes. she's her own woman ✨
• -draft — create a IETF draft proxy instead of the default RFC 3280-compliant proxy. this type of proxy uses a non-standard proxy policy identifier. might be useful for authenticating with older versions of the Globus Toolkit.
• -old — create a legacy proxy instead of the default RFC 3280-compliant proxy. this type uses a non-standard method of indicating that the certificate is a proxy and whether it is limited. might be useful for authenticating with older versions of the Globus Toolkit.
• -rfc — create an RFC 3820-compliant proxy certificate. this is the default for this version of grid-proxy-init. the moment. the icon. the legend. 👑

---

✨ EXAMPLES ✨

want a proxy with the default lifetime and format? just run grid-proxy-init with no arguments, no notes. for example:

% grid-proxy-init
Your identity: /DC=org/DC=example/CN=Joe User
Enter GRID pass phrase for this identity: XXXXXXX
Creating proxy .................................. Done
Your proxy is valid until: Thu Mar 18 03:48:05 2010

look at those dots filling in. satisfying. 🍓

and if you want a stronger proxy that lasts for only 8 hours, use the -hours and -bits command-line options. for example:

% grid-proxy-init -hours 8 -bits 4096
Your identity: /DC=org/DC=example/CN=Joe User
Enter GRID pass phrase for this identity: XXXXXXX
Creating proxy .................................. Done
Your proxy is valid until: Thu Mar 17 23:48:05 2010

4096 bits and only 8 hours? she's powerful but she knows when to go home. 💅

---

✨ ENVIRONMENT ✨

the following environment variables affect the execution of grid-proxy-init:

• X509_USER_CERT — path to the certificate to use as issuer of the new proxy.
• X509_USER_KEY — path to the key to use to sign the new proxy.
• X509_CERT_DIR — path to the directory containing trusted certificates and signing policies.

---

✨ FILES ✨

the following files affect the execution of grid-proxy-init:

• $HOME/.globus/usercert.pem — default path to the certificate to use as issuer of the new proxy.
• $HOME/.globus/userkey.pem — default path to the key to use to sign the new proxy.

---

✨ SEE ALSO ✨

grid-proxy-destroy(1), grid-proxy-info(1) — yes, there's a whole friend group. destroy her when you're done, info her when you're curious. 🌈

---

✨ AUTHOR ✨

Copyright © 1999-2014 University of Chicago. iconic lineage honestly. 🎀

---

and that's the whole page bestie!! 💖 this one comes to you from the Grid Community Toolkit 6, dated 03/31/2018, and you already know she's serving GRID-PROXY-INIT(1) realness from start to finish. go make yourself a proxy, stay safe, and delete your proxies when you're done — i'm not asking, i'm telling you. mwah 💋✨