1GRID-PROXY-INIT(1) Globus Commands GRID-PROXY-INIT(1)
2
6 grid-proxy-init - Generate a new proxy certificate
7
9 grid-proxy-init [-help] [-usage] [-version]
10 grid-proxy-init [-debug] [-q] [-verify]
12 [[-valid HOURS:MINUTES] | [-hours HOURS]]
13 [-cert CERTFILE] [-key KEYFILE] [-certdir CERTDIR]
14 [-out PROXYPATH] [-bits BITS]
15 [-policy POLICYFILE]
16 [[-pl POLICY-OID] | [-policy-language POLICY-OID]]
17 [-path-length MAXIMUM] [-pwstdin] [-limited]
18 [-independent] [[-draft] | [-old] | [-rfc]]
19
21 The grid-proxy-init program generates X.509 proxy certificates derived
22 from the currently available certificate files. By default, this
23 command generates a RFC 3820[1] Proxy Certificate with a 512 bit key
24 valid for 12 hours in a file named /tmp/x509up_uUID. Command-line
25 options and variables can modify the format, strength, lifetime, and
26 location of the generated proxy certificate.
27 X.509 proxy certificates are short-lived certificates, signed usually
29 by a user´s identity certificate or another proxy certificate. The key
30 associated with a proxy certificate is unencrypted, so applications can
31 authenticate using a proxy identity without providing a passphrase.
32 Proxy certificates provide a convenient alternative to constantly
34 entering passwords, but are also less secure than the user´s normal
35 security credential. Therefore, they should always be user-readable
36 only (this is enforced by the GSI libraries), and should be deleted
37 after they are no longer needed.
38 This version of grid-proxy-init supports three different proxy formats:
40 the old proxy format used in early releases of the Globus Toolkit up to
41 version 2.4.x, an IETF draft version of X.509 Proxy Certificate profile
42 used in Globus Toolkit 3.0.x and 3.2.x, and the RFC 3820 profile used
43 in Globus Toolkit Version 4.0.x and 4.2.x. By default, this version of
44 grid-proxy-init creates an RFC 3820 compliant proxy. To create a proxy
45 compatible with older versions of the Globus Toolkit, use the -old or
46 -draft command-line options.
47 The full set of command-line options to grid-proxy-init are:
49 -help, -usage
51 Display the command-line options to grid-proxy-init.
52 -version
54 Display the version number of the grid-proxy-init command
55 -debug
57 Display information about the path to the certificate and key used
58 to generate the proxy certificate, the path to the trusted
59 certificate directory, and verbose error messages
60 -q
62 Suppress all output from grid-proxy-init except for passphrase
63 prompts.
64 -verify
66 Perform certificate chain validity checks on the generated proxy.
67 -valid HOURS:MINUTES, -hours HOURS
69 Create a certificate that is valid for HOURS hours and MINUTES
70 minutes. If not specified, the default of twelve hours and no
71 minutes is used.
72 -cert CERTFILE, -key KEYFILE
74 Create a proxy certificate signed by the certificate located in
75 CERTFILE using the key located in KEYFILE. If not specified the
76 default certificate and key will be used. This overrides the values
77 of environment variables described below.
78 -certdir CERTDIR
80 Search CERTDIR for trusted certificates if verifying the proxy
81 certificate. If not specified, the default trusted certificate
82 search path is used. This overrides the value of the X509_CERT_DIR
83 environment variable
84 -out PROXYPATH
86 Write the generated proxy certificate file to PROXYPATH instead of
87 the default path of /tmp/x509up_uUID.
88 -bits BITS
90 When creating the proxy certificate, use a BITS bit key instead of
91 the default 512 bit keys.
92 -policy POLICYFILE
94 Add the certificate policy data described in POLICYFILE as the
95 ProxyCertInfo X.509 extension to the generated proxy certificate.
96 -pl POLICY-OID, -policy-language POLICY-OID
98 Set the policy language identifier of the policy data specified by
99 the -policy command-line option to the oid specified by the
100 POLICY-OID string.
101 -path-length MAXIMUM
103 Set the maximum length of the chain of proxies that can be created
104 by the generated proxy to MAXIMUM. If not set, the default of an
105 unlimited proxy chain length is used.
106 -pwstdin
108 Read the private key´s passphrase from stdin instead of reading
109 input from the controlling tty. This is useful when scripting
110 grid-proxy-init.
111 -limited
113 Create a limited proxy. Limited proxies are generally refused by
114 process-creating services, but may be used to authorize with other
115 services.
116 -independent
118 Create an independent proxy. An independent proxy is not treated as
119 an impersonation proxy but as a separate identity for authorization
120 purposes.
121 -draft
123 Create a IETF draft proxy instead of the default RFC 3280-compliant
124 proxy. This type of proxy uses a non-standard proxy policy
125 identifier. This might be useful for authenticating with older
126 versions of the Globus Toolkit.
127 -old
129 Create a legacy proxy instead of the default RFC 3280-compliant
130 proxy. This type of proxy uses a non-standard method of indicating
131 that the certificate is a proxy and whether it is limited. This
132 might be useful for authenticating with older versions of the
133 Globus Toolkit.
134 -rfc
136 Create an RFC 3820-compliant proxy certificate. This is the default
137 for this version of grid-proxy-init.
138
140 To create a proxy with the default lifetime and format, run the
141 grid-proxy-init program with no arguments. For example:
142 % grid-proxy-init
144 Your identity: /DC=org/DC=example/CN=Joe User
145 Enter GRID pass phrase for this identity:
146 Creating proxy .................................. Done
147 Your proxy is valid until: Thu Mar 18 03:48:05 2010
148 To create a stronger proxy that lasts for only 8 hours, use the -hours
150 and -bits command-line options to grid-proxy-init. For example:
151 % grid-proxy-init -hours 8 -bits 1024
153 Your identity: /DC=org/DC=example/CN=Joe User
154 Enter GRID pass phrase for this identity:
155 Creating proxy .................................. Done
156 Your proxy is valid until: Thu Mar 17 23:48:05 2010
157
160 The following environment variables affect the execution of
161 grid-proxy-init:
162 X509_USER_CERT
164 Path to the certificate to use as issuer of the new proxy.
165 X509_USER_KEY
167 Path to the key to use to sign the new proxy.
168 X509_CERT_DIR
170 Path to the directory containing trusted certifiate certificates
171 and signing policies.
172
174 The following files affect the execution of grid-proxy-init:
175 $HOME/.globus/usercert.pem
177 Default path to the certificate to use as issuer of the new proxy.
178 $HOME/.globus/userkey.pem
180 Default path to the key to use to sign the new proxy.
181
183 For more information about proxy certificate types and their
184 compatibility in GT, see
185 http://dev.globus.org/wiki/Security/ProxyCertTypes.
186
188 grid-proxy-destroy(1), grid-proxy-info(1)
189
191 University of Chicago
192
194 1. RFC 3820
195 http://www.ietf.org/rfc/rfc3820.txt
196Globus Toolkit 5.0.2 04/25/2011 GRID-PROXY-INIT(1)