VOMS-PROXY-FAKE(1)

okay bestie, pull up a chair, we're reading a manpage together and it's gonna be a whole ✨moment✨ This is the page for voms-proxy-fake, straight out of the VOMS Client manual. It's giving certificate-wizardry, it's giving fake-it-till-you-make-it, and honestly? Obsessed. 💅

---

🌸 NAME 🌸

voms-proxy-fake — create a proxy with VOMS extensions

---

🦋 SYNOPSIS 🦋

voms-proxy-fake [options]

---

✨ DESCRIPTION ✨

So here's the vibe: voms-proxy-fake whips up a proxy that's carrying arbitrary attributes — and it does it without ever contacting the VOMS server. No server call, no waiting, just vibes. 🫶

---

💖 OPTIONS 💖

First things first, bestie: options can be written with either a - prefix or a -- prefix, and nobody's gonna gatekeep you about which one. Pick your fighter. 💅

• -help — shows you the usage. The "what do I even do here" button.
• -version — shows the version. Iconic, brief, slay.
• -debug — turns on extra debug output. For when you need the tea. ☕
• -q — quiet mode, minimal output. Lowkey, reserved, mysterious. 🤫
• -verify — verifies the certificate you're making a proxy for.
• -pwstdin — lets the passphrase come in from stdin.
• -limited — creates a limited proxy. Not all proxies get the full main character treatment.
• -hours H — the proxy is valid for H hours. Default is 12.
• -vomslife H — tries to get an AC with information that's valid for H hours. The default is "as long as the proxy certificate". The special value 0 means as long as the server will allow.
• -bits B — number of bits in the key, one of {0|512|1024|2048|4096}. 0 is the special one: it means same number of bits as in the issuing certificate.
• -cert certfile — non-standard location of the user certificate.
• -key keyfile — non-standard location of the user key.
• -certdir certdir — location of the trusted certificates dir.
• -out proxyfile — location of the new proxy cert.
• -voms voms[:command] — specifies the fake VOMS server that's gonna appear in the attribute certificate. Heads up: command is ignored — it's only hanging around for compatibility with voms-proxy-init. 🙈
• -include file — includes file in the certificate (in a non critical extension).
• -conf file — read options from file.
• -policy — the file containing the policy expression.
• -policy-language pl — the language the policy is expressed in. Default is IMPERSONATION_PROXY.
• -path-length — maximum depth of proxy certificate that can be signed from this.
• -globus version — this one is obsolete, bestie. It's only here for backwards compatibility with old installations, and currently its value is just... ignored. 💀
• -proxyver — the version of the proxy certificate to create. Can be 2 or 3. The default is decided by the underlying globus version.
• -separate file — saves the voms credential onto the file file.
• -hostcert file — the cert that will be used to sign the AC.
• -hostkey file — the key that will be used to sign the AC.
• -fqan file — the string that will be included in the AC as the granted FQAN.
• -newformat — forces the server to generate ACs in the new (correct) format. It's a compatibility feature, meant to ease migration while the servers upgrade to the new version.
• -newsubject newdn — the created proxy will have newdn as its subject instead of whatever it would normally have, depending on the specific version of proxy created. Non-printable characters can be specified with the '\XX' encoding, where XX are two hexadecimal characters.
• -newissuer newdn — the created proxy will have newdn as its issuer instead of whatever it would normally have, depending on the specific version of proxy created. Non-printable characters can be specified with the '\XX' encoding, where XX are two hexadecimal characters.
• -newserial newserial — the created proxy will have newserial as its serial number. You have to write the new serial number as a hex representation, and any length is possible. If you don't specify this option, voms-proxy-fake will pick the serial number itself.
• -pastac timespec — the created AC will have its validity start in the past, as specified by timespec.

The format of timespec is one of: seconds, hours:minutes, hours:minutes:seconds.

• -pastproxy timespec — the created proxy will have its validity start in the past, as specified by timespec.

The format of timespec is one of: seconds, hours:minutes, hours:minutes:seconds.

• -nscert bit,...,bit — the created proxy will have the specified bits in the Netscape Certificate Extension. Acceptable values for bit are: client, server, email, objsign, sslCA, emailCA, objCA. The default is not to have this extension at all.
• -extkeyusage bit,...,bit — the created proxy will have the specified bits in the Extended Key Usage Extension. Acceptable values for bit are: serverAuth, clientAuth, codeSigning, emailProtection, timeStamping, msCodeInd, msCodeCom, msCTLSign, msSGC, msEFS, nsSGC, deltaCRL. The default is not to have this extension.
• -keyusage bit,...,bit — the created proxy will have the specified bits in the Key Usage Extensions. Acceptable values for bit are: digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyAgreement, keyCertSign, cRLSign, encipherOnly, decipherOnly. The default is to copy these extensions from the issuer certificate, while removing the keyCertSign and nonRepudiation bits if present.
• -selfsigned — the created certificate will be a self-signed certificate and will have a CA=true bit in the Basic constraints Exception. She's her own icon, her own issuer, her own everything. 👑
• -extension oid[/criticality]value — lets you specify additional extensions to be put in the created certificate.
  • oid is the Object Identifier of the extension. Any OID may be used, even one that isn't already known in advance. This must always be specified — there is no default.
  • criticality says whether the extension is critical or not, and it must be either true or false. If it's absent, it defaults to false.
  • value is the value of the extension. It's made of two subfields: type and content. type is a single character that says how content gets interpreted. ':' means content is a text string to be included as is. '~' means content is a hex representation of the string. '+' means content is the name of a file which will contain the actual data.
• -acextension oid[/criticality]value — lets you specify additional extensions to be put in the created attribute certificate.
  • oid is the Object Identifier of the extension. Any OID may be used, even one that isn't already known in advance. This must always be specified — there is no default.
  • criticality says whether the extension is critical or not, and it must be either true or false. If it's absent, it defaults to false.
  • value is the value of the extension. It's made of two subfields: type and content. type is a single character that says how content gets interpreted. ':' means content is a text string to be included as is. '~' means content is a hex representation of the string. '+' means content is the name of a file which will contain the actual data.
• -ga id = value [(qualifier)] — adds the generic attribute you specify to the generated AC. Btw, spaces before and after the = character get swallowed on the command line, so don't stress about them. 🫶
• -voinfo file — the file file contains information for additional ACs that should be included in the created proxy. ACs specified via the -voinfo option get added before the ACs specified via command line options.

The format of the file is the following:

[voname]

parameter=value

parameter=value

...

---

🎀 BUGS 🎀

EGEE Bug Tracking Tool[1]

---

🌈 SEE ALSO 🌈

• voms-proxy-fake(1), voms-proxy-init(1), voms-proxy-info(1), voms-proxy-destroy(1)
• EDT Auth Home page[2]
• CVSweb[3]
• RPM repository[4]

---

👑 AUTHORS 👑

• Vincenzo Ciaschini <Vincenzo.Ciaschini@cnaf.infn.it>
• Valerio Venturi <Valerio.Venturi@cnaf.infn.it>

---

💜 COPYRIGHT 💜

Copyright (c) Members of the EGEE Collaboration. 2004. See the beneficiaries list for details on the copyright holders.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

www.apache.org/licenses/LICENSE-2.0[5]

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

---

🧚 NOTES 🧚

1. EGEE Bug Tracking Tool — https://savannah.cern.ch/projects/jra1mdw/
2. EDT Auth Home page — http://grid-auth.infn.it
3. CVSweb — http://datagrid.in2p3.fr/cgi-bin/cvsweb.cgi/Auth/voms
4. RPM repository — http://datagrid.in2p3.fr/distribution/autobuild/i386-rh7.3
5. www.apache.org/licenses/LICENSE-2.0 — http://www.apache.org/licenses/LICENSE-2.0

---

And that's the whole page, bestie, you ate that. 🍓 This was brought to you by the VOMS Client, dated 05/03/2021 — go forth and fake those proxies, no cap. 💅✨🦋