VOMS-PROXY-INIT(1)

💖 VOMS-PROXY-INIT 💖

okay bestie, welcome to voms-proxy-init(1) — the VOMS Client era. this is the little tool that ✨makes you a proxy✨ with VOMS info baked in. let's go 🫶

🌸 NAME 🌸

voms-proxy-init — create a proxy with VOMS extensions ✨

🦋 SYNOPSIS 🦋

voms-proxy-init [options]

👑 DESCRIPTION 👑

so basically voms-proxy-init generates a proxy, and it puts all the VOMS information inside a non critical extension. that's the whole vibe. that's it. it's giving "I have credentials and I want them fancy." 💅

✨ OPTIONS ✨

okay so first thing, bestie: you can write any of these with either a - or a -- prefix, literally doesn't matter, they're the same. and the options from -help all the way down to -out? those exist purely for compatibility with grid-proxy-init, and they mean exactly the same thing. the rest of them, here's the tea:

-help — shows you the usage. that's it. that's the whole job.
-usage — also displays usage. twin behavior 💅
-version — displays version. say hi to the version number 👋
-debug — enables extra debug output. if something's being weird, this is your girl 🔍
-quiet — quiet mode, minimal output. she's shy.
-q — same thing, quiet mode, minimal output. two names, one vibe.
-verify — verifies the proxy. vibe check on your credentials ✅
-pwstdin — allows passphrase from stdin. type it in, don't be shy 🔐
-limited — creates a limited proxy. less power, still valid ✨
-hours H — proxy is valid for H hours (default: 12). ⚠️ this option is deprecated and is only hanging around for compatibility with grid-proxy-init, because it does not set the validity of the credentials returned by VOMS. use -valid instead, bestie, fr fr.
-vomslife H — tries to get a pseudo cert with information valid for H hours. the default is "as long as the proxy certificate". the special value 0 means as long as the server will allow. ⚠️ deprecated, since it does not set the validity of the generated proxy. use -valid instead. i'm serious.
-valid HH:MM — this one tries to set the validity for both the proxy and the credentials returned by the VOMS server. the latter validity may however be shortened due to server policy (server said no, basically 😭). this option obsoletes both -hours and -vomslife, and you should use it in preference to both. periodt.
-bits B — number of bits in key {0|512|1024|2048|4096}. 0 is a special value which means: same number of bits as in the issuing certificate. cute ✨
-cert certfile — non-standard location of user certificate.
-key keyfile — non-standard location of user key.
-certdir certdir — non standard location where the trusted CAs certificates are kept.
-out proxyfile — location of new proxy cert.
-voms voms[:command] — specifies the VOMS server to contact using the nickname voms. it also lets you send a specific command to the server. the default command is :all, and it gets all group membership information. other commands are :/Role=rolename which grants the rolename VO-wide role if the server allows it, and :/group/Role=rolename which grants the role rolename only in the group /group, again only if the server allows it. 👑

Example:

voms-proxy-init --voms myVO:/myVO/Role=VO-Admin

-order fqan — specified fqans, if present, are put on top of the list of attributes returned by the server in the order in which they are passed (using more -order calls). the order of the others is not specified. if some of the fqans are not returned, no warning is given. and jsyk, capability selection is not supported.
-include file — includes file in the certificate (in a non critical extension).
-conf file — read options from file.
-confile file — same as above, and also same as below. three synonyms, one destiny.
-userconf file — same trio. ⚠️ -confile and -userconf are deprecated. use -vomses instead, bestie.
-vomses file — specifies the name of a configuration file from which a list of nicknames is read. the format of the file is the following:

nick host port subject vo

where nick is the nickname, host and port are the hostname and port of the server to contact, subject is the subject of the server's certificate, while vo is the name of the VO that owns the server. the default filenames are $PREFIX/etc/vomses and $HOME/.voms/vomses.

moreover, permissions must be 644 if a file is specified, and 755 if a directory is specified. 🔐 don't skip this part, the permissions are not a suggestion.

these three options are synonyms (-conf, -confile, -userconf). -confile and -userconf are deprecated. -vomses should be used instead. slay.

-policy — the file containing the policy expression.
-policy-language pl — the language in which the policy is expressed. default is IMPERSONATION_PROXY.
-pl pl — also the language in which the policy is expressed. default is IMPERSONATION_PROXY. twin 💅
-path-length — maximum depth of proxy certfificate that can be signed from this. (yes, "certfificate" — i'm keeping it exactly as written, no cap 🫶)
-globus version — this option is obsolete and only present for backwards compatibility with old installations. currently, its value is ignored. she's just there for the memories 🙈
-proxyver — version of the proxy certificate to create. may be 2, 3 or 4. default value is decided upon underlying globus version.
-rfc — this option is a synonym of -proxyver 4 and it generates a RFC-compliant proxy. ✨
-old — this option is a synonym of -proxyver 2 and it generates a legacy proxy. throwback vibes 💜
-target hostname — this option targets the generated AC to a specific host. this option may be specified multiple times to allow for multiple hosts. collect them all 🎀
-timeout seconds — this option allows you to specify the maximum number of seconds that voms-proxy-init will wait while trying to establish a connection with the server. its default value is -1 (unlimited). no clock, no stress.
-noregen — use existing proxy to contact the server and to sing the new proxy. (yes — "sing". it's in the original. we love a musical moment 🎶💅)
-separate file — saves the voms credential on file file.
-ignorewarn — ignore all warnings. they are not shown to the user. 🙈
-failonwarn — warnings become failures. the program will translates all warnings into errors and will react accordingly, by returning a failure itself. (again, keeping the original's exact wording, "will translates" and all — i don't make the rules 🫶)
-list — instead of producing an attribute certificate, this optin will print on screen a list of all attributes available to the user. ("optin" — original wording, iconic typo, we stan 🌈)
-includeac file — adds the VOMS AC in file file to the proxy.

💀 BUGS 💀

EGEE Bug Tracking Tool[1] — that's the bug situation, bestie. it is what it is.

🌈 SEE ALSO 🌈

voms-proxy-info(1), voms-proxy-destroy(1) — the rest of the squad 💜
EDT Auth Home page[2]
CVSweb[3]
RPM repository[4]

👑 AUTHORS 👑

Vincenzo Ciaschini <Vincenzo.Ciaschini@cnaf.infn.it> 💖
Valerio Venturi <Valerio.Venturi@cnaf.infn.it> 💖

🎀 COPYRIGHT 🎀

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. you may obtain a copy of the License at

www.apache.org/licenses/LICENSE-2.0[5]

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. see the License for the specific language governing permissions and limitations under the License. ⭐

📎 NOTES 📎

EGEE Bug Tracking Tool https://savannah.cern.ch/projects/jra1mdw/
EDT Auth Home page http://grid-auth.infn.it
CVSweb http://datagrid.in2p3.fr/cgi-bin/cvsweb.cgi/Auth/voms
RPM repository http://datagrid.in2p3.fr/distribution/autobuild/i386-rh7.3
www.apache.org/licenses/LICENSE-2.0 http://www.apache.org/licenses/LICENSE-2.0

okay bestie that's the whole page 💅 this one's from the VOMS Client, dated 05/03/2021, and it's lowkey iconic. go make yourself a proxy, you ate. 🦋✨👑

📦 where this page comes from

nixpkgs unstable: voms 2.1.4
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on 2026-10-18: a language model's rewrite of the original, under its terms