Differences

This shows you the differences between two versions of the page.

--- cern:certificates [2011/10/03 12:17] – tmp nchiap
+++ cern:certificates [2014/07/22 21:10] (current) – [New Certificate Authority] nchiap
@@ Line 1: / Line 1: @@
 ====== Managing Certificates ======
-(still to be improved)
+(not everything has been tested)
 =====A Basic Introduction to Public-Key-Cryptography=====
-All this business with certificates uses public-key cryptography. The basic idea is, that everyone has a key-pair consisting of **a private and a public key**. As the name suggests the private key is kept private, the public one is made public. Messages encrypted with one of the keys can only be decrypted with the other. We will now look at the three most common ways to use this fact.
+All this business with certificates uses public-key cryptography. The basic idea is, that everyone has a key-pair consisting of **a private and a public key**. As the name suggests the private key is kept private, the public one is made public. Messages encrypted with one of the keys can only be decrypted with the other. We will now look at the most common ways to use this fact.
 ==== Private Messages ====
@@ Line 17: / Line 17: @@
 ==== Certificates ====
-A possible solution for this are certificates. A is a document that contains your public key and other information about you. It has to be signed by a Certificate Authority (CA). With it's signature the Certificate Authority confirms that they checked your identity and the information in the certificate is valid.
+A possible solution for this are certificates. A certificate is a document that contains your public key (and maybe other information about you). It has to be signed by a Certificate Authority (CA). With it's signature the Certificate Authority confirms that they checked your identity and that the information in the certificate is valid.
-Obviously the certificate is useless without the private key belonging to it or once the private key got compromised. So make sure to protect your private key properly, nobody else should be able to get the file with it.
+Obviously the certificate is useless without the private key belonging to it or once the private key got compromised. So make sure to protect your private key properly, nobody else should be able to get the file with it and you should not loose it.
 =====
@@ Line 26: / Line 26: @@
 (Of course now the problem is how to distribute the public key of the Certificate Authority. Still this is a comparatively easy problem.)
+CERN has its own Certificate Authority. You find its website under [[https://ca.cern.ch]].
-=====Doing the work=====
+===== Obtaining a key-pair and certificate from CERN =====
-CERN has its own Certificate Authority. You find its website under [[https://ca.cern.ch]].
-==== getting started ====
+==== New Certificate Authority ====
+  - Request a [[https://gridca.cern.ch/gridca/user/Request.aspx | new user Certificate.]] (use Firefox, this may not work other browsers)
+  - Follow [[https://gridca.cern.ch/gridca/Help/?kbid=024010 | How to use your certificate with grid-proxy-init.]]
+=====other useful things =====
+====print public key====
+from your private key you can generate the corresponding public key
+  openssl rsa -in privkey.pem -pubout
+====print certificate details====
+you can print all the information stored in your certificate
+  openssl x509 -text -noout -in certificate.pem
+==== create a pkcs12 file (used by web-browsers) ====
+(tested with Firefox and Opera)
+To use the certificate for authentication on websites you need to combine the certificate and the private-key into a pkcs12 file
+  openssl pkcs12 -export -inkey privkey.pem -in certificate.cer -out combined.p12
+You can then import this file into the certificate configuration of your browser
+(Firefox: edit > preferences > advanced > view certificates)
+==== export from a pkcs12 file====
+export the certificate
+  openssl pkcs12 -clcerts -nokeys -in combined.p12 -out certificat.pem
+export the private key
+  openssl pkcs12 -nocerts -in combined.p12 -out privkey.pem
+if you work on a SLC machine, you can also use a special script for this:
+  cert-convert.sh combined.p12
+===== Useful Links=====
+  * [[http://www.madboa.com/geek/openssl/]]
+  * [[http://ca.cern.ch/]]
+  * [[https://twiki.cern.ch/twiki/bin/view/LHCb/FAQ/Certificate]]
+  * [[https://lcg-voms.cern.ch:8443/vo/lhcb/vomrs]]
+====== Outdated ======
+The explanation below is outdated.
+CERN does not sign certificate requests for existing keys any longer.
+You will have to generate a new pair with a private-key and certificate every year.
+=====Getting Started (generate a first key pair and certificate) =====
 First you will need to generate a key pair and prepare a certificate request.
-For this you log into lxplus and change to the private directory. There you run
+For this you log into lxplus and change to the **private** directory. There you run
   openssl req -new -out myrequest.csr # request a new certificate and  store it in myrequest.csr
 Since you specified no private key the command above generates a private key first.
@@ Line 43: / Line 85: @@
 **myreqeust.csr** contains the certificate request.
-The next step is to upload the certificate request to the Certificate Authority.
+The next step is to get the certificate request signed by the Certificate Authority.
-Select [[https://ca.cern.ch/ca/Certificates/reqtxts.aspx|Request or renew user certificate manually]].
+Select [[https://ca.cern.ch/ca/Certificates/reqtxts.aspx|Request or renew user certificate manually]] on [[https://ca.cert.ch]].
-Then copy and paste its content into the form.
+After you passed the identity check a from with one large text box will be shown to you.
+Copy and paste the content of myrequest.csr into the form.
+After submitting the form you get back a **.cer** file containing your certificate.
+I recommend you safe this under something like ''cert_YYYY-MM-DD.cer''.
+=====Preparing for Grid Usage (on lxplus)=====
+To use your certificate for the grid you need to copy the two files in ~/.globus with the following names:
+  certificat: usercert.pem
+  privat key: userkey.pem
+It is a good idea to create a symbolic link instead of a copy.
+This helps you to know which certificate you actually use.
+You can then test your setup by calling
+  lhcb-proxy-init
-from your private key you can generate the corresponding public key:
+=====Obtaining  a New Certificate (renewal)=====
-  openssl rsa -in privatkey.pem -pubout
+You can not really renew an old certificate.
-(you use the RSA backend with your privat-key as input and output the public key)
+Instead you need to acquire a new certificate for your existing key-pair.
-The public key is what other people can use to send you encrypted messages -
+  openssl req -new -key privkey.pem # request a new certificate using your private key
-or decrypt things you encrypted with your private key.
-====obtaining a new certificate (renewal)====
+The next step is now again to [[https://ca.cern.ch/ca/Certificates/reqtxts.aspx|copy and paste the certificat request]] into the form of the Authority.
-you can as well prepare a certificate request:
+Again you get a signed certificate back and store it with a helpful name.
-  openssl req -new -key privatkey.pem # request a new certificate that confirms your private key
+Probably you will then want to update your files in ~/.globus, so copy the **.cer** into that directory and replace the symlink for ''usercert.pem''.
-A certificate contains info about you and is signed with the
-private key of you and the Certificat Authority.
-So the next step is to upload the certificat request to the Authority
-from where you get a signed certificat.
-====using the certificate====
-===for web-browsing===
-to use the certificate in a browser (firefox or opera) you need to combine the
-certificate and the private-key into a pkcs12 file:
-  openssl pkcs12 -export -inkey privatkey.pem -in certificat.cer -out combined.p12
-from the pkcs12 file you get can export your keys:
-  openssl pkcs12 -nokeys -in combined.p12 -out certificat.pem
-  openssl pkcs12 -nocerts -in combined.p12 -out privatekey.pem
-===for the grid===
-for gird-usage put files in ~/.globus:
-  usercert.pem  (certificat)
-  userkey.pem   (privat key)
-===== Useful Links=====
-[[http://www.madboa.com/geek/openssl/]]

Physik-Institut

LHCb Wiki Pages

Differences

Physik-Institut

LHCb Wiki Pages

User Tools

Site Tools

Differences

Page Tools