    NAME
         util/sgeCA/sge_ca - Sun Grid Engine CSP Support control com-
         mand

    SYNTAX
         sge_ca command [command options]

    DESCRIPTION
         sge_ca controls a simple Sun Grid Engine Certificate Author-
         ity that is used for the special Certificate Security Proto-
         col (CSP) mode.  CSP mode improves the security behavior  of
         Sun  Grid  Engine  by enabling OpenSSL secured communication
         channels and  X509v3  certificates  for  authentication.  In
         addition  it  is  possible  to export the key material or to
         create JKS keystores for the JMX connector.   It  follows  a
         list  of  possible  commands  and command options to give an
         overview  which  functionality  is  available.  For  further
         details  about  every  command  refer to the COMMAND DETAILS
         section.

    COMMAND OVERVIEW
         sge_ca [-help]
              show usage

         sge_ca -init [command options]
              create the infrastructure for a  new  Sun  Grid  Engine
              Certificate  Authority with its corresponding files and
              directories and a set of keys and certificates for  SGE
              Daemon, root and admin user.

         sge_ca -req | -verify <cert> | -sign | -
              copy [command options]
              manipulate individual keys and certificates

         sge_ca -print <cert> | -printkey <key> | -printcrl <crl>
              print out certificates, keys and certificate revocation
              lists in human readable form.

         sge_ca -showCaTop | -showCaLocalTop [command options]
              echo the $CATOP or $CALOCALTOP directory. This  command
              is  usually  run as root on the qmaster host after a CA
              infrastructure has been  created.  If  "-cadir"  or  "-
              catop"  or  "-calocaltop"  are  set  the  corresponding
              directories are printed.

    hedeby_introduction(1) )

    options]
         sge_ca -pkcs12 <user> | -sdm_pkcs12 <g>  |  -
              sys_pkcs12  [command
              are used to export the certificate  and  key  for  user
              <user> or SDM daemon <g> in pkcs12 format and to export
              the SGE Daemon certificate and key in pkcs12 format.

         sge_ca -userks | -ks <user> | -sysks [command options]
              are used for creation of keystore for all users with  a
              certificate  and  key,  the  keystore for a single user
              <user> and the keystore containing the SGE Daemon  cer-
              tificate and key.

    [command options]
         sge_ca -renew <user> | -renew_ca | -renew_sys  |  -
              renew_sdm  <g>
              are used to renew the  corresponding  certificates  for
              user <user>, for the CA, for the SGE Daemon certificate
              and for the SDM daemon <g> certificate.

         where "[command options]" is a combination of the  following
         options  depending  on the command. The COMMAND DETAILS sec-
         tion explains which options are usable for each command.

         -days <days>
              days of validity of the certificate

         -sha1
              use sha-1 instead of md5 as message digest

         -encryptkey
              use des to encrypt the generated  private  key  with  a
              passphrase.  The  passphrase is requested when a key is
              created or used.

         -outdir <dir>
              write to directory <dir>

         -cahost <host>
              define CA hostname (CA master host)

         -cadir <dir>
              define $CALOCALTOP and $CATOP settings

         -calocaltop <dir>
              define $CALOCALTOP setting

         -catop <dir>
              define $CATOP setting

         -kspwf <file>
              define  a  keystore  password  file  that  contains   a
              password  that  is used to encrypt the keystore and the
              keys contained therein

         -ksout <file>
              define output file to write the keystore to

         -pkcs12pwf <file>
              define a pkcs12 password file that contains a  password
              that  is used to encrypt the pkcs12 export file and the
              keys contained therein

         -pkcs12dir <dir>
              define the output directory <dir> to write the exported
              pkcs12  format  file  to. Otherwise the current working
              directory is used.

    COMMAND DETAILS
    [-adminuser <admin>] [-days <num days>]
         sge_ca -init [-cadir <dir>] [-catop  <dir>]  [-
              calocaltop  <dir>]
              The -init command creates a new Sun Grid Engine  certi-
              ficate  authority  and its corresponding files. Usually
              "sge_ca -init" is run by user root on the master  host.
              If  the options -adminuser, -cadir, -calocaltop, -catop
              and the Sun Grid Engine environment variables SGE_ROOT,
              SGE_CELL  and  SGE_QMASTER_PORT  are  set the CA direc-
              tories are created in the following locations:
              two letter country code, state, location, e.g  city  or
              your  buildingcode,  organization  (e.g.  your  company
              name), organizational unit, e.g. your department, email
              address of the CA administrator (you!)

              Certificates and keys are generated for the CA  itself,
              for SGE Daemon, for SGE install user (usually root) and
              finally for the SGE admin user.

              How and where the certificates and keys are created can
              be influenced additionally by:
              -days <days> change the time of validity of the  certi-
              ficates to number of <days> instead of 365 days
              -sha1 change the message digest algorithm from  md5  to
              sha-1
              -encryptkey  encrypt  the   generated   keys   with   a
              passphrase
              -adminuser <user> use <user> as admin user
              -cahost <host> use <host> as the CA master host
              [-cadir <dir>] [-catop <dir>  [-calocaltop  <dir>]  set
              $CATOP  and  $CALOCALTOP to <dir> to use something dif-
              ferent than the Sun Grid  Engine  default  directories.
              Either  -cadir  <dir>  has  to  be specified to replace
              $CATOP and $CALOCALTOP by the same directory or  -catop
              <dir> for $CATOP and -calocaltop <dir> for $CALOCALTOP.

    sge_ca The command must be  usually  called  with  Sun  Grid
         Engine  root  permissions  on  the  master  host.   For more
         details on the permission requirements consult the  detailed
         description for the different commands above.

    FILES
         sge_ca creates a file tree starting in $CATOP and  $CALOCAL-
         TOP.     The     default     for     $CATOP    is    usually
         $SGE_ROOT/$SGE_CELL/common/sgeCA   and    for    $CALOCALTOP
         /var/sgeCA/{port$SGE_QMASTER_PORT|sge_qmaster}/$SGE_CELL
         where the subpaths beginning with $ expands to  the  content
         of the corresponding environment variable.

         In addition there may optionally exist the user  certificate
         in $HOME/.sge/port$SGE_QMASTER_PORT/$SGE_CELL/certs/cert.pem
         and     the      corresponding      private      key      in
         $HOME/.sge/port$SGE_QMASTER_PORT/$SGE_CELL/private/key.pem
         which are used instead of the files in $CATOP and  $CALOCAL-
         TOP. (see sge_ca -copy above)

    SEE ALSO
         sge_qmaster(8).

    COPYRIGHT
         See sge_intro(1) for a full statement of rights and  permis-
         sions.