GRID-DEFAULT-CA(8)

💖 GRID-DEFAULT-CA 💖

okay bestie, this is the grid-default-ca page from the Grid Community Toolkit Manual (section 8, system admin vibes 👑). it's literally the tool that picks which certificate authority your cert requests go to. let's get into it 🫶

---

✨ NAME ✨

grid-default-ca — Select default CA for certificate requests 🎀

---

🌸 SYNOPSIS 🌸

grid-default-ca -help | -h | -usage | -u | -version | -versions

grid-default-ca [-ca CA-HASH | -list ] [OPTIONS]

---

💅 DESCRIPTION 💅

so grid-default-ca is the program that sets the default certificate authority to use when the grid-cert-request script gets run. main character energy fr.

BUT here's the thing — for you to be able to request certificates from a CA, that CA's certificate, configuration, and signing policy all have to be installed in the trusted certificate directory first. no certificate, no config, no policy, no requests. periodt.

also lowkey important: some CAs have different policies and use other tools to handle certificate requests. so if you're unsure, please go consult your CA's support staff, bestie. they know their setup, i promise. 💜

and just so we're clear — grid-default-ca is designed to work with CAs implemented using the globus_simple_ca package. iykyk.

so how does it behave? by default, the grid-default-ca program displays a list of installed CA certificates and then prompts the user for which one to set as the default. interactive queen ✨

but there's options, obviously:

• If it's invoked with the -list command-line option, grid-default-ca will print the list and not prompt nor set the default CA. just window shopping 🛍️
• If it's invoked with the -ca option, it will not list or prompt, but set the default CA to the one with the hash that matches the CA-HASH argument to that option. direct, decisive, slay.
• If grid-default-ca is used to set the default CA, the caller of this program must have write permissions to the trusted certificate directory. no write perms, no setting the default. sorry bestie, that's just the rules 😭

now where does it actually set this CA? it sets it in one of the grid security directories. it looks in:

• the directory named by the GRID_SECURITY_DIR environment
• the X509_CERT_DIR environment
• /etc/grid-security
• $GLOBUS_LOCATION/share/certificates

it just goes down the list like a group chat scroll 🦋

---

🎀 OPTIONS 🎀

the full set of command-line options to grid-default-ca are, and yes i'm giving you all of them because you deserve the full picture:

• -help, -h, -usage, -u — Display the command-line options to grid-default-ca and exit. the "wait what does this do again" button 🙈
• -version, -versions — Display the version number of the grid-default-ca command. the second form includes more details. one is the short version, one is the director's cut 💅
• -dir CA-DIRECTORY — Use the trusted certificate directory named by CA-DIRECTORY instead of the default. you're overriding the default location, iconic behavior.
• -list — Instead of changing the default CA, print out a list of all available CA certificates in the trusted certificate directory. looking, not touching 👀
• -ca CA-HASH — Set the default CA without displaying the list of choices or prompting. the CA file named by CA-HASH must exist. if it doesn't... it's giving nothing. 💀

---

🌈 EXAMPLES 🌈

first up: list the contents of the trusted certificate directory that contain the string Example:

% grid-default-ca | grep Example
15) cd1186ff -  /DC=org/DC=Example/DC=Grid/CN=Example CA

and now choose that CA as the default:

% grid-default-ca -ca cd1186ff
setting the default CA to: /DC=org/DC=Example/DC=Grid/CN=Example CA
linking /etc/grid-security/certificates/grid-security.conf.cd1186ff to
        /etc/grid-security/certificates/grid-security.conf
linking /etc/grid-security/certificates/grid-host-ssl.conf.cd1186ff  to
        /etc/grid-security/certificates/grid-host-ssl.conf
linking /etc/grid-security/certificates/grid-user-ssl.conf.cd1186ff  to
        /etc/grid-security/certificates/grid-user-ssl.conf
...done.

see that ...done.?? that's the little dopamine hit at the end. obsessed. ✨

---

🦋 ENVIRONMENT 🦋

the following environment variables affect the execution of grid-default-ca:

• GRID_SECURITY_DIRECTORY — Path to the default trusted certificate directory.
• X509_CERT_DIR — Path to the default trusted certificate directory.
• GLOBUS_LOCATION — Path to the Grid Community Toolkit installation directory.

(yes, GRID_SECURITY_DIRECTORY and X509_CERT_DIR are both "Path to the default trusted certificate directory". they're twin flames, don't question it 💜)

---

💀 BUGS 💀

okay so here's where it gets a little messy, no cap:

• The grid-default-ca program displays CAs from all of the directories in its search list; however, grid-cert-request only uses the first which contains a grid security configuration. so what you see isn't necessarily what gets used. 🙈
• The grid-default-ca program may display the same CA multiple times if it is located in multiple directories in its search path. However, it does not provide any information about which one would actually be used by the grid-cert-request command. so you're just out here guessing, bestie. it's giving mystery. 🔥

---

⭐ SEE ALSO ⭐

grid-cert-request(1)

---

👑 AUTHOR 👑

Copyright © 1999-2014 University of Chicago

---

and that's the whole page!! 🌸 this was Grid Community Toolkit 6, dated 03/31/2018 — stay slaying, go set your default CA responsibly, and remember: write permissions or it's not happening 💖🫶✨