(still to be improved)

All this business with certificates uses public-key cryptography. The basic idea is, that everyone has a key-pair consisting of a private and a public key. As the name suggests the private key is kept private, the public one is made public. Messages encrypted with one of the keys can only be decrypted with the other. We will now look at the three most common ways to use this fact.

If anyone wants to send you a private message. He takes your public key and encrypts his message. Since only you know the private key, only you will be able to decrypt and read the message.

If you encrypt a message with your private key, everyone will be able to decrypt and read it. But since only you could have encrypted the message this proofs your identity. This idea can in addition be used to electronically sign a document.

This is what you use when initializing a grid-proxy or when you log into a website with your certificate.

There is still a problem with this setup. How do you distribute your public keys? Since you will authenticate your self using this key, you need to make sure that the key arrives at its destination untampered. In addition the distribution needs to happen over the internet - nothing else would be possible for a system like the Grid.

A possible solution for this are certificates. A is a document that contains your public key and other information about you. It has to be signed by a Certificate Authority (CA). With it's signature the Certificate Authority confirms that they checked your identity and the information in the certificate is valid.

Obviously the certificate is useless without the private key belonging to it or once the private key got compromised. So make sure to protect your private key properly, nobody else should be able to get the file with it.

After you obtained a certificate, distributing your public key is easy. You send certificate to your partner. He checks the signature from the Certificate Authority. If the signature is valid, he can trust the your public key.

(Of course now the problem is how to distribute the public key of the Certificate Authority. Still this is a comparatively easy problem.)

CERN has its own Certificate Authority. You find its website under https://ca.cern.ch.

First you will need to generate a key pair and prepare a certificate request. For this you log into lxplus and change to the private directory. There you run

openssl req -new -out myrequest.csr # request a new certificate and  store it in myrequest.csr

Since you specified no private key the command above generates a private key first. You get asked for a password to secure your private key with. Choose a good one and do not forget it. After that you can provide additional information about yourself if you want. You can just press enter if you want. When done you have two files in your current directory. privkey.pem will contain your private key, myreqeust.csr contains the certificate request.

The next step is to upload the certificate request to the Certificate Authority. Select Request or renew user certificate manually. Then copy and paste its content into the form.

After submitting the form you get back a .cer file containing your certificate. I recommend you safe this under something like cert_YYYY-MM-DD.cer.

To use your certificate for the grid you need to copy the two files in ~/.globus with the following names:

certificat: usercert.pem
privat key: userkey.pem 

You can create a symlink instead of a copy as well.

you can as well prepare a certificate request:

openssl req -new -key privatkey.pem # request a new certificate that confirms your private key

A certificate contains info about you and is signed with the private key of you and the Certificat Authority.

So the next step is to upload the certificat request to the Authority from where you get a signed certificat.

from your private key you can generate the corresponding public key:

openssl rsa -in privatkey.pem -pubout

(you use the RSA backend with your privat-key as input and output the public key) The public key is what other people can use to send you encrypted messages - or decrypt things you encrypted with your private key.

to use the certificate in a browser (firefox or opera) you need to combine the certificate and the private-key into a pkcs12 file:

openssl pkcs12 -export -inkey privatkey.pem -in certificat.cer -out combined.p12

from the pkcs12 file you get can export your keys:

openssl pkcs12 -nokeys -in combined.p12 -out certificat.pem
openssl pkcs12 -nocerts -in combined.p12 -out privatekey.pem

for gird-usage put files in ~/.globus:

usercert.pem  (certificat)
userkey.pem   (privat key)

http://www.madboa.com/geek/openssl/