VOMS-PROXY-INIT(1)

📦
version 3.4.0 · 9 versions
, in fedora 43, fedora 44

✨ VOMS-PROXY-INIT(1) ✨

okay bestie, sit down, hydrate, because this is the manual page for voms-proxy-init from section 1 of the manual, and honestly? it's a banger 💖

🎀 NAME 🎀

voms-proxy-init — creates a proxy certificate with VOMS extensions. that's it, that's the whole job, and she does it flawlessly 💅

🌸 SYNOPSIS 🌸

voms-proxy-init [options]

just the command and whatever options your heart desires, no positional args, no drama ✨

🦋 DESCRIPTION 🦋

okay so the tea is: voms-proxy-init generates a proxy that has your VOMS info baked right in, tucked into an X.509 non critical extension. like a little secret note in your certificate's pocket 🫶

Where do those VOMS attributes even come from? a known VOMS server, bestie. the list of known VOMS servers lives in a vomses configuration file, and the syntax of that file is documented in the vomses man page. wanna point at a custom vomses location? pass the --vomses option and you're golden ✨

heads up: VOMS attributes are only requested if you actually pass the -voms option on the command line, and you use it to say which Virtual Organizations (VOs) you want attributes for. no -voms, no attributes. periodt 💀

VOMS attributes get signed by the VOMS server that issues them. then the signature is verified on the client side using local trust info, which is typically chillin' in /etc/grid-security/vomsdir. the vomsdir structure is documented in the vomsdir man page, and you can point at a custom vomsdir with the --vomsdir option 🎀

the default location of the proxy that voms-proxy-init spits out is:

/tmp/x509up_u<user_id>

where user_id is the effective user id of whoever's running the command. want it somewhere else? the -out option has you covered 💖

🔥 Requesting VOMS attributes 🔥

you ask for attributes with the -voms option. basic usage looks like this:

voms-proxy-init -voms <voname>

where voname is the name of one of your configured VOs. that command creates a proxy holding a VOMS extension with all group attributes belonging to the user — the whole collection, no crumbs left behind 👑

VOMS roles are conditional attributes, which means they only get included in a VOMS attribute certificate when you explicitly ask for them. requesting a role looks like:

voms-proxy-init -voms atlas:/atlas/Role=pilot

✨ Ordering requested attributes ✨

typically, VOMS attributes come back in the order you requested them on the command line. for example, this:

voms-proxy-init -voms infngrid:/infngrid/group1 -voms infngrid:/infngrid/Role=pilot

will produce an Attribute Certificate where the primary attribute is /infngrid/group1, followed by /infngrid/Role=pilot, and then by the other attributes belonging to the user. the way the order just works? iconic. and if you wanna be extra about it, -order can also express order requirements 💅

🎀 Setting the validity period of the generated proxy and attribute certificate 🎀

by default, voms-proxy-init generates a proxy valid for 12 hours, including a VOMS extension valid for the same time (if you requested one). wanna change those windows? use the -valid option, which sets the validity of both the proxy and the AC.

important caveat: the validity of the AC can only be "proposed" by voms-proxy-init, because the AC validity is actually set by the VOMS server, and its maximum value is limited by local VOMS server configuration (typically that max is 24 hours). so don't come for voms-proxy-init if your AC is shorter, she tried her best 😭

🌈 Setting the type of proxy generated by voms-proxy-init 🌈

by default, voms-proxy-init generates a legacy proxy compatible with Globus Toolkit version 2. change that vibe with the -rfc option, which produces an RFC3820 compliant proxy. and if you want a Globus Toolkit version 3 proxy — i.e. a draft compliant proxy — use -proxyver 3 ✨

💜 CONFIGURATION 💜

local configuration for trusted VOs is needed for voms-proxy-init to work properly. no cap. check the vomses(5) and vomsdir(5) man pages for the deets 🫶

💅 OPTIONS 💅

options may be specified using either a - or -- prefix. either one, she's flexible like that 💖

  • -b, --bits <num-bits> — number of bits in the key. it's {512|1024|2048|4096} 🔐
  • --cert <certfile> — nonstandard location of the user certificate 🎀
  • --certdir <certdir> — nonstandard location of the trusted cert dir 📁
  • --conf <file> — read options from <file> 📜
  • --debug — enables extra debug output. she gets chatty 🗣️
  • --dont_verify_ac — skips AC verification. bold move, bestie 🙈
  • -f, --failonwarn — treat warnings as errors. zero tolerance era 💀
  • --help — displays help and exits ✨
  • --hours <hours> — sets the generated proxy validity to H hours (default: 12). note that this option only sets the lifetime of the generated proxy — use -valid to set the lifetime for both the proxy and the AC ⏰
  • --ignorewarn — ignore warnings. live your truth 🌸
  • -k, --key <keyfile> — non standard location of the user key 🔑
  • --limited — creates a limited proxy 🫥
  • -n, --noregen — use an existing proxy certificate to obtain VOMS attributes and to sign the newly generated proxy ♻️
  • --old — creates a legacy, GT2 compliant proxy (synonymous with -proxyver 2) 🦕
  • --order <fqan> — the fqan given here is set as the primary FQAN if it's present in the list of attributes returned by the server. use this option more than once if you want to set the order for more than one FQAN 📋
  • --out <proxyfile> — non standard location of the generated proxy certificate 💾
  • --path_length <L> — allow a chain of at most L proxies to be generated and signed from the proxy created by voms-proxy-init ⛓️
  • --proxyver <2|3|4> — sets the type of proxy generated by VOMS proxy init. 2 stands for legacy proxy, 3 for draft proxy, 4 for rfc proxy. use -old or -rfc instead of this option 💅
  • --pwstdin — reads private key passphrase from standard input 📥
  • -q, --quiet — quiet mode, minimal output 🤫
  • -r, --rfc — creates an RFC 3820 compliant proxy (synonymous with -proxyver 4) 📜
  • --target <hostname> — targets the AC against a specific hostname. multiple targets can be expressed by using this option multiple times 🎯
  • --usage — displays help and exits ✨
  • --valid <h:m> — sets generated proxy and AC validity to h hours and m minutes (defaults to 12:00). note that the VOMS server could shorten the validity of the issued AC depending on the server configuration ⌛
  • --verify — verifies the validity of the user certificate ✅
  • --version — displays version 🏷️
  • --voms <voms<:fqan>> — specifies the VO for which the AC is requested. <:fqan> is optional, and is used to ask for specific attributes (e.g. --voms atlas:/atlas/Role=pilot). this option can be used multiple times to request multiple FQANs for different VOs. the order in which the option appears on the command line influences the order of the issued attributes 👑
  • --vomsdir <DIR> — sets the path where lsc files and other local VOMS trust anchors will be looked for 🔍
  • --vomses <vomses file> — specifies the name of a VOMSES file from which VOMS server contact information is parsed 📖
  • --vomslife <h:m> — sets the validity of the requested VOMS attribute certificate to h hours and m minutes (defaults to the value of the -valid option) ⏳

😭 BUGS 😭

to report bugs or ask for support, use GGUS: https://ggus.eu/pages/home.php

(no gatekeeping, just file it 💖)

👑 AUTHORS 👑

  • Enrico Vianello enrico.vianello@cnaf.infn.it
  • Francesco Giacomini francesco.giacomini@cnaf.infn.it

legends, honestly 🌟

🫶 SEE ALSO 🫶

voms-proxy-destroy(1), voms-proxy-info(1), vomses(5), vomsdir(5)

and that's the whole page, bestie 💖 this version of the VOMS-PROXY-INIT(1) manual page is dated 2026-10-09, so if you're reading this from the future, hey, slay ✨ mwah, go make some proxies 🎀💅

📦 where this page comes from