SGE_CA(8)

💖 NAME 💖

Okay so like, this is SGE_CA(8), bestie — the manual page for util/sgeCA/sge_ca, the Grid Engine CSP Support control command. 🎀

---

✨ SYNTAX ✨

sge_ca command [command options]

---

🌸 DESCRIPTION 🌸

So sge_ca controls a simple Grid Engine Certificate Authority that is used for the special Certificate Security Protocol (CSP) mode. CSP mode improves the security behavior of Grid Engine by enabling OpenSSL secured communication channels and X509v3 certificates for authentication. In addition it is possible to export the key material or to create JKS keystores for the JMX connector. 💅

There follows a list of possible commands and command options to give an overview of what functionality is available. For further details about every command refer to the COMMAND DETAILS section. 👑

---

👑 COMMAND OVERVIEW 👑

• -help — Show usage. 🫶
• -init [command options] — Create the infrastructure for a new Grid Engine Certificate Authority with its corresponding files and directories, and a set of keys and certificates for the Grid Engine daemon, root and admin user. ✨
• -req | -verify cert | -sign | -copy [command options] — Manipulate individual keys and certificates. 🛠️
• -print cert | -printkey key | -printcrl crl — Print out certificates, keys and certificate revocation lists in human readable form. 📜
• -showCaTop | -showCaLocalTop [command options] — Echo the $CATOP or $CALOCALTOP directory. This command is usually run as root on the qmaster host after a CA infrastructure has been created. If "-cadir", "-catop" or "-calocaltop" are set, the corresponding directories are printed. 👀
• -usercert user file | -user u:g:e | -sdm_daemon u:g:e [command options] — Create certificates and keys for a bunch of users contained in user file, a single user, or SDM daemon in the form u:g:e. 🧑‍🤝‍🧑
• -pkcs12 user | -sdm_pkcs12 g | -sys_pkcs12 [command options] — Export the certificate and key for user user or SDM daemon g in PKCS12 format and to export the Grid Engine daemon certificate and key in PKCS12 format. 🔐
• -userks | -ks user | -sysks [command options] — Create keystore for all users with a certificate and key, the keystore for a single user user, or the keystore containing the Grid Engine daemon certificate and key. 🗝️
• -renew user | -renew_ca | -renew_sys | -renew_sdm g [command options] — Renew the certificate for user user, for the CA, for the Grid Engine daemon, or the SDM daemon with common name g. The old certificate remains valid until it expires. NB. The option of this name was re-named to -rrenew in Grid Engine 8.1.9. ⏳
• -rrenew user | -rrenew_ca | -rrenew_sys | -rrenew_sdm g [command options] — Renew the certificate for user user, for the CA, for the Grid Engine daemon, or the SDM daemon with common name g, and revoke the old ones (updating the revocation list). NB. This requires unique_subject=no in sge_ssl_template.cnf, which is the default for new installations, but might not be set for old ones. 🚨
• -revoke cert — Revoke the certificate cert, which should be an actual PEM file, updating the revocation list. ❌

In the above, "command options" is a combination of the following options depending on the command. The COMMAND DETAILS section explains which options are usable for each command. 💖

• -days days — days of validity of the certificate. 📅
• -sha1 — Use SHA-1 instead of MD5 as message digest. 🔐
• -encryptkey — Use DES to encrypt the generated private key with a passphrase. The passphrase is requested when a key is created or used. 🔑
• -outdir dir — Write to directory dir. 📁
• -cahost host — Define CA hostname (CA master host). 🏠
• -cadir dir — Define $CALOCALTOP and $CATOP settings as dir. 📂
• -calocaltop dir — Define $CALOCALTOP setting. 📍
• -catop dir — Define $CATOP setting. 📍
• -kspwf file — Define a keystore password file that contains a password that is used to encrypt the keystore and the keys contained therein. 🔒
• -ksout file — Define output file to write the keystore to. 💾
• -pkcs12pwf file — Define a PKCS12 password file that contains a password that is used to encrypt the PKCS12 export file and the keys contained therein. 🔒
• -pkcs12dir dir — Define the output directory dir to write the exported PKCS12 format file to. Otherwise the current working directory is used. 📂

💖 COMMAND DETAILS 💖

okay bestie, this is the part where we get into the actual commands. every single one is a whole thing, and you're gonna know all of them. no cap. 🫶

🎀 sge_ca -init 🎀

sge_ca -init [-cadir dir] [-catop dir] [-calocaltop dir] [-adminuser
admin] [-days num days]

the -init command creates a new Grid Engine certificate authority and its corresponding files. usually sge_ca -init is run by user root on the master host. if the options -adminuser, -cadir, -calocaltop, and -catop are not used, and the Grid Engine environment variables SGE_ROOT, SGE_CELL and SGE_QMASTER_PORT are set, the CA directories are created in these locations:

• $SGE_ROOT/$SGE_CELL/common/sgeCA (can be overruled by -catop dir or -cadir dir)
• /var/lib/sgeCA/port$SGE_QMASTER_PORT/$SGE_CELL or /var/lib/sgeCA/sge_qmaster/$SGE_CELL (can be overruled by -calocaltop dir or -cadir dir).

the following information must be delivered for the site: two letter country code, state, location, e.g. city or your building code, organization (e.g. your company name), organizational unit, e.g. your department, and email address of the CA administrator (you!). 💅

certificates and keys are generated for the CA itself, the Grid Engine daemon, installation user (usually root), and finally for the admin user. ✨

how and where the certificates and keys are created can be influenced additionally by:

options that tweak the vibe

• -days days — change the time of validity of the certificates to number of days instead of 365 days.
• -sha1 — change the message digest algorithm from MD5 to SHA-1.
• -encryptkey — encrypt the generated keys with a passphrase.
• -adminuser user — use user as admin user.
• -cahost host — use host as the CA master host.
• [-cadir dir] [-catop dir] [-calocaltop dir] — set $CATOP and $CALOCALTOP to dir to use something other than the Grid Engine default directories. either -cadir dir has to be specified to replace $CATOP and $CALOCALTOP by the same directory, or -catop dir for $CATOP and -calocaltop dir for $CALOCALTOP.

---

🦋 sge_ca -user 🦋

sge_ca -user u:g:e [-cadir dir] [-catop dir] [-calocaltop dir]
[-adminuser admin] [-days days]

generate user certificate and keys for u:g:e, where u is the user id, g is the "common name" (real name of the user), and e is the user's email address. by default the certificate is valid for 365 days or for days, as specified with -days days. this command is usually run as user root on the qmaster host. $CATOP and $CALOCALTOP may be overruled by -cadir, -catop, and -calocaltop.

🌸 sge_ca -sdm_daemon 🌸

sge_ca -sdm_daemon u:g:e

generate daemon certificate and keys for u:g:e with parameters and lifetime as for -user. this command is usually run as user root on the qmaster host.

💜 sge_ca -usercert 💜

sge_ca -usercert user file [-cadir dir] [-catop dir] [-calocaltop dir]
[-adminuser admin] [-days days] [-encryptkey] [-sha1]

usually sge_ca -usercert user file is run as user root on the master host. the argument user file contains a list of users in the following format:

  eddy:Eddy Smith:eddy@griders.org
  sarah:Sarah Miller:sarah@griders.org
  leo:Leo Lion:leo@griders.org

where the fields separated by colon are:

  Unix user:Gecos field:email address

🍓 sge_ca -renew 🍓

sge_ca -renew user [-cadir dir] [-catop dir] [-calocaltop dir]
[-adminuser admin] [-days days]

renew the certificate for user. by default the certificate is extended for 365 days or for days specified with -days days. if the value is negative the certificate becomes invalid. this command is usually run as user root on the qmaster host. $CATOP and $CALOCALTOP may be overruled by -cadir, -catop, and -calocaltop.

🧚 sge_ca -renew_ca 🧚

sge_ca -renew_ca [-cadir dir] [-catop dir] [-calocaltop dir] [-adminuser
admin] [-days days]

renew the CA certificate, similarly to -renew.

🌈 sge_ca -renew_sys 🌈

sge_ca -renew_sys [-cadir dir] [-catop dir] [-calocaltop dir]
[-adminuser admin] [-days days]

renew the Grid Engine daemon certificate, similarly to -renew.

⭐ sge_ca -renew_sdm ⭐

sge_ca -renew_sdm g [-cadir dir] [-catop dir] [-calocaltop dir]
[-adminuser admin] [-days days]

renew the SDM daemon certificate of g, where g is the common name of the daemon, similarly to -renew.

🔥 sge_ca -pkcs12 🔥

sge_ca -pkcs12 user [-pkcs12pwf file] [-pkcs12dir dir] [-cadir dir]
[-catop dir] [-calocaltop dir] [-adminuser admin]

export certificate and key of user user (Unix user name) in PKCS12 format. this command is usually run as user root on the qmaster host. if -pkcs12pwf file is used, the file and the corresponding key will be encrypted with the password in file. if -pkcs12dir dir is used, the output file is written into dir/user.p12 instead of ./user.p12. $CATOP and $CALOCALTOP may be overruled by -cadir, -catop, and -calocaltop.

👑 sge_ca -sys_pkcs12 👑

sge_ca -sys_pkcs12 [-pkcs12pwf file] [-pkcs12dir dir] [-cadir dir]
[-catop dir] [-calocaltop dir] [-adminuser admin]

export certificate and key of Grid Engine daemon in PKCS12 format, similarly to -pkcs12.

💀 sge_ca -sdm_pkcs12 💀

sge_ca -sdm_pkcs12 g [-pkcs12pwf file] [-pkcs12dir dir] [-cadir dir]
[-catop dir] [-calocaltop dir] [-adminuser admin]

export certificate and key of SDM daemon with common name g in PKCS12 format,, similarly to -renew.

🎀 sge_ca -ks 🎀

sge_ca -ks user [-ksout file] [-kspwf file] [-cadir dir] [-catop dir]
[-calocaltop dir] [-adminuser admin]

create a keystore containing certificate and key of user user in JKS format where user is the Unix user name. this command is usually run as user root on the qmaster host. if -kspwf file is used the keystore and the corresponding key will be encrypted with the password in file. the -ksout file option specifies the keystore file that is created. if the -ksout file option is missing the default location for the keystore is $CALOCALTOP/userkeys/user/keystore. this command is usually invoked by sge_ca -userks. a prerequisite is a valid JAVA_HOME environment variable setting. $CATOP and $CALOCALTOP may be overruled by -cadir, -catop and -calocaltop.

✨ sge_ca -userks ✨

sge_ca -userks [-kspwf file] [-cadir dir] [-catop dir] [-calocaltop dir]
[-adminuser admin]

generate a keystore in JKS format for all users having a key and certificate. this command is usually run as user root on the qmaster host. if -kspwf file is used, the keystore and the corresponding key will be encrypted with the password in file. the keystore files are created in $CALOCALTOP/userkeys/user/keystore. this command is run after user certificates and keys have been created with 0ercert userfile or if any of the certificates have been renewed. $CATOP and $CALOCALTOP may be overruled by -cadir, -catop and -calocaltop.

🫶 sge_ca -sysks 🫶

sge_ca -sysks [-kspwf file] [-cadir dir] [-catop dir] [-calocaltop dir]
[-adminuser admin]

generate a keystore containing the Grid Engine daemon certificate and key in JKS format. this command is usually run as user root on the qmaster host. if -kspwf file is used the keystore and the corresponding key will be encrypted with the password in file. the keystore file is created in $CALOCALTOP/private/keystore. $CATOP and $CALOCALTOP may be overruled by -cadir, -catop and -calocaltop.

🌸 sge_ca -print 🌸

sge_ca -print cert

print a PEM-format certificate cert.

🌸 sge_ca -printkey 🌸

sge_ca -printkey key

print a PEM-format key key.

🌸 sge_ca -printcrl 🌸

sge_ca -printcrl crl

print a PEM-format certificate revocation list crl.

💜 sge_ca -req 💜

sge_ca -req [-cadir dir] [-catop dir] [-calocaltop dir] [-adminuser
admin] [-days days] [-encryptkey] [-sha1] [-outdir dir]

create a private key and a certificate request for the calling user. these are created as newkey.pem and newreq.pem in the current working directory. if the option -outdir dir is specified in addition the files are created in dir.

🍓 sge_ca -sign 🍓

sge_ca -sign [-cadir dir] [-catop dir] [-calocaltop dir] [-adminuser
admin] [-days days] [-encryptkey] [-sha1] [-outdir dir]

sign a certificate request. the CA certificate under $CATOP (default $SGE_ROOT/$SGE_CELL/common/sgeCA), and CA key from $CALOCALTOP (default /var/sgaCA/{port$SGE_QMASTER_PORT|sge_qmaster}/$SGE_CELL) are used for the signature. if $CATOP and $CALOCALTOP are set to a different directory the information there is used. the certificate is created as newcert.pem in the current working directory or in dir if the option -outdir dir has been specified. in addition the option "-days number of days" can be specified to change the default validity from 365 to number of days.

🧚 sge_ca -verify 🧚

sge_ca -verify cert [-cadir dir] [-catop dir] [-calocaltop dir]
[-adminuser admin]

verify a certificate's validity where cert is the certificate in pem format. $CATOP and $CALOCALTOP can be overruled by -cadir, -catop and -calocaltop.

🌈 sge_ca -copy 🌈

sge_ca -copy [-cadir dir] [-catop dir] [-calocaltop dir]

run by a user to copy their certificate and key on the master host to $HOME/.sge/port$SGE_QMASTER_PORT/$SGE_CELL/certs/cert.pem and the corresponding private key to $HOME/.sge/port$SGE_QMASTER_PORT/$SGE_CELL/private/key.pem, which are used instead of the files in $CATOP and $CALOCALTOP. the command is only recommended for testing purposes, or where $HOME is on a secure shared file system.

---

✨ EXAMPLES ✨

🎀 create a whole CA vibe

# sge_ca -init -cadir /tmp -sha1 -encryptkey -days 31

create a CA infrastructure in /tmp with a certificate validity of 31 days using SHA-1 instead of MD5 as message digest. the keys are encrypted and a passphrase has to be entered during the creation of the different keys or during signing a certificate with the created CA key.

🦋 user cert moment

# sge_ca -usercert /tmp/myusers.txt -cadir /tmp

/tmp/myusers.txt contains

user1:My User:user1@myorg.org

and user1 is a valid Unix user account. create a key and certificate for user1.

💜 keystore for everyone

# sge_ca -userks -cadir /tmp

create a keystore for all users of the simple CA. the keystore is stored under /tmp/userkeys/user/keystore.

🔥 root cert, temporarily invalid

# sge_ca -renew root -cadir /tmp -days -1

make the root certificate temporarily invalid.

⭐ renew the CA

# sge_ca -renew_ca -days 365 -cadir /tmp

renew the CA certificate for 365 days.

---

🌈 ENVIRONMENT VARIABLES 🌈

• SGE_ROOT — specifies the location of the Grid Engine standard configuration files.
• SGE_CELL — if set, specifies the default Grid Engine cell.

🔒 RESTRICTIONS

Okay bestie, listen up because this is the ✨gatekeeping✨ part: sge_ca usually has to be called with Grid Engine root permissions on the master host. That's the vibe. It's giving "you need the master key to the whole kingdom" 👑

If you wanna know the exact permission tea for each individual command, go scroll back up — the detailed descriptions for the different commands above have all the specifics. I'm not about to re-read that whole thing to you, iykyk 💅

---

📁 FILES

So sge_ca doesn't just do stuff, it creates a whole file tree starting in $CATOP and $CALOCALTOP. Very main character, very "I built this empire myself" 🏰

The defaults are:

• $CATOP — usually $SGE_ROOT/$SGE_CELL/common/sgeCA
• $CALOCALTOP — /var/lib/sgeCA/{port$SGE_QMASTER_PORT|sge_qmaster}/$SGE_CELL

and yes, those subpaths that start with $ expand to the content of the corresponding environment variable — that's the whole trick, no cap 🧚

---

🎀 optional lil extras

There may also optionally exist, if you're feeling fancy:

• the user certificate at $HOME/.sge/port$SGE_QMASTER_PORT/$SGE_CELL/certs/cert.pem
• the corresponding private key at $HOME/.sge/port$SGE_QMASTER_PORT/$SGE_CELL/private/key.pem

and those two get used instead of the files in $CATOP and $CALOCALTOP. (Peep sge_ca -copy above, it's literally the origin story 💖)

---

📜 the config files

• SGE_ROOT/util/sgeCA/sge_ssl_template.cnf — OpenSSL configuration file.
• SGE_ROOT/util/sgeCA/sge_ssl.cnf — OpenSSL configuration file used for signing.

Both iconic, both essential, both just sitting there in util/sgeCA doing their little cryptographic thing 🌸

---

👀 SEE ALSO

• sge_qmaster(8).

That's it. That's the list. One (1) friend. Small circle, high standards 🫶

---

©️ COPYRIGHT

For the full statement of rights and permissions, go check out sge_intro(1) — it's all laid out there, legally speaking, no vibes just facts ⭐

---

and that's a wrap on SGE_CA(8), bestie 🎀 This whole thing is from SGE 8.1.3pre, dated 2011-05-19, and it's the SGE_CA(8) page — yes, the manpage is older than some of us and it's still out here being useful. Respect the elders 🙈💜 Go forth and manage your certs responsibly, mwah 💋