Changes between Version 9 and Version 10 of iRODSwithGSI

Timestamp:

12/03/12 18:32:17 (11 years ago)

Author:

Jeanne Ohren

Comment:

--

iRODSwithGSI

@@ -347 +347 @@
      However, a hash link and signing_policy need to be created for each cert.
 
-2a.  Move the trusted_roots directory to /home/johren/.globus/certificates.
-
-2b.  Determine the hash for the certificate and create the link
-{{{
-}}}
-
-2c.  Create the signing_policy file and create a hash link for this.
-{{{
+2a.  Go to the trusted_)roots directory
+{{{
+   cd trusted_roots
+}}}
+
+2b.  For each certificate, determine the hash for the certificate and create the link
+{{{
+globus@pc-0:~/irodscerts/trusted_roots$ openssl x509 -in ch-cert.pem -hash -noout
+0894ffd6
+globus@pc-0:~/irodscerts/trusted_roots$ ln -s ch-cert.pem 0894ffd6.0
+}}}
+
+2c.  Determine the subject of each certificate
+{{{
+  openssl x509 -in <certificate-file> -subject -noout
+}}}
+
+2d.  Create the signing_policy file (e.g. ch-cert.signing_policy) with contents like the following (where access_id_CA is the subject of the CA found in step 2c).
+{{{
+access_id_CA   X509    '/CN=geni//gpo//gcf.authority.sa'
+pos_rights     globus  CA:sign
+cond_subjects  globus  '/*'
+}}}
+
+2e.  Create a symlink to the signing policy using the hash determined above.
+{{{
+   ln -s ch-cert.signing_policy 0894ffd6.0
 }}}
 
@@ -362 +381 @@
   * The CA certificate directory
 
+Your CA certificate directory (e.g. trusted_roots) should looks something like this:
+{{{
+pc:~/.globus/certificates% ls -l
+total 28
+lrwxrwxrwx 1 johren pgeni-gpolab-bbn   11 Nov 28 09:33 0894ffd6.0 -> ch-cert.pem
+lrwxrwxrwx 1 johren pgeni-gpolab-bbn   22 Nov 28 09:57 0894ffd6.signing_policy -> ch-cert.signing_policy
+lrwxrwxrwx 1 johren pgeni-gpolab-bbn   11 Nov 28 09:33 18f0c2ad.0 -> ma-cert.pem
+lrwxrwxrwx 1 johren pgeni-gpolab-bbn   22 Nov 28 09:57 18f0c2ad.signing_policy -> ma-cert.signing_policy
+lrwxrwxrwx 1 johren pgeni-gpolab-bbn   10 Nov 28 09:32 aacaba34.0 -> cacert.pem
+lrwxrwxrwx 1 johren pgeni-gpolab-bbn   21 Nov 28 09:56 aacaba34.signing_policy -> cacert.signing_policy
+-rw-r--r-- 1 johren pgeni-gpolab-bbn  916 Nov 28 09:31 cacert.pem
+-rw-r--r-- 1 johren pgeni-gpolab-bbn  111 Nov 28 09:53 cacert.signing_policy
+-rw-r--r-- 1 johren pgeni-gpolab-bbn 3023 Nov 28 09:31 CATedCACerts.pem
+-rw-r--r-- 1 johren pgeni-gpolab-bbn  834 Nov 28 12:31 ch-cert.pem
+-rw-r--r-- 1 johren pgeni-gpolab-bbn  116 Nov 28 09:54 ch-cert.signing_policy
+-rw-r--r-- 1 johren pgeni-gpolab-bbn 1273 Nov 28 09:31 ma-cert.pem
+-rw-r--r-- 1 johren pgeni-gpolab-bbn  111 Nov 28 09:55 ma-cert.signing_policy
+}}}
 ===== Server =====