SGE_CA(8)             Grid Engine Administrative Commands            SGE_CA(8)



NNAAMMEE
       util/sgeCA/sge_ca - Grid Engine CSP Support control command

SSYYNNTTAAXX
       ssggee__ccaa ccoommmmaanndd [[ccoommmmaanndd ooppttiioonnss]]

DDEESSCCRRIIPPTTIIOONN
       ssggee__ccaa controls a simple Grid Engine Certificate Authority that is used
       for the special Certificate Security Protocol  (CSP)  mode.   CSP  mode
       improves  the  security  behavior  of  Grid  Engine by enabling OpenSSL
       secured communication channels and X509v3 certificates for  authentica-
       tion.  In addition it is possible to export the key material or to cre-
       ate JKS keystores for the JMX connector.  It follows a list of possible
       commands and command options to give an overview which functionality is
       available. For further details about every command refer to the COMMAND
       DETAILS section.

CCOOMMMMAANNDD OOVVEERRVVIIEEWW
       ssggee__ccaa [[--hheellpp]]
              show usage

       ssggee__ccaa --iinniitt [[ccoommmmaanndd ooppttiioonnss]]
              create  the  infrastructure  for  a  new Grid Engine Certificate
              Authority with its corresponding files and directories and a set
              of keys and certificates for SGE Daemon, root and admin user.

       ssggee__ccaa --rreeqq || --vveerriiffyy <<cceerrtt>> || --ssiiggnn || --ccooppyy [[ccoommmmaanndd ooppttiioonnss]]
              manipulate individual keys and certificates

       ssggee__ccaa --pprriinntt <<cceerrtt>> || --pprriinnttkkeeyy <<kkeeyy>> || --pprriinnttccrrll <<ccrrll>>
              print out certificates, keys and certificate revocation lists in
              human readable form.

       ssggee__ccaa --sshhoowwCCaaTToopp || --sshhoowwCCaaLLooccaallTToopp [[ccoommmmaanndd ooppttiioonnss]]
              echo the $CATOP or $CALOCALTOP directory. This command  is  usu-
              ally  run  as root on the qmaster host after a CA infrastructure
              has been created. If "--ccaaddiirr" or "--ccaattoopp" or  "--ccaallooccaallttoopp"  are
              set the corresponding directories are printed.

       ssggee__ccaa  --uusseerrcceerrtt  <<uusseerr  ffiillee>>  ||  --uusseerr <<uu::gg::ee>> || --ssddmm__ddaaeemmoonn <<uu::gg::ee>>
       [[ccoommmmaanndd ooppttiioonnss]]
              are  used  for  creation of certificates and keys for a bunch of
              users contained in <user file>, a  single  user  or  SDM  daemon
              <u:g:e>. (see _h_e_d_e_b_y___i_n_t_r_o_d_u_c_t_i_o_n(1) )

       ssggee__ccaa --ppkkccss1122 <<uusseerr>> || --ssddmm__ppkkccss1122 <<gg>> || --ssyyss__ppkkccss1122 [[ccoommmmaanndd ooppttiioonnss]]
              are  used  to  export the certificate and key for user <user> or
              SDM daemon <g> in pkcs12 format and to  export  the  SGE  Daemon
              certificate and key in pkcs12 format.

       ssggee__ccaa --uusseerrkkss || --kkss <<uusseerr>> || --ssyysskkss [[ccoommmmaanndd ooppttiioonnss]]
              are  used for creation of keystore for all users with a certifi-
              cate and key, the keystore for a single user <user> and the key-
              store containing the SGE Daemon certificate and key.

       ssggee__ccaa --rreenneeww <<uusseerr>> || --rreenneeww__ccaa || --rreenneeww__ssyyss || --rreenneeww__ssddmm <<gg>> [[ccoommmmaanndd
       ooppttiioonnss]]
              are  used  to  renew  the  corresponding  certificates  for user
              <user>, for the CA, for the SGE Daemon certificate and  for  the
              SDM daemon <g> certificate.

       where  "[[ccoommmmaanndd  ooppttiioonnss]]"  is  a combination of the following options
       depending on the command. The COMMAND DETAILS  section  explains  which
       options are usable for each command.

       --ddaayyss <<ddaayyss>>
              days of validity of the certificate

       --sshhaa11  use sha-1 instead of md5 as message digest

       --eennccrryyppttkkeeyy
              use  des to encrypt the generated private key with a passphrase.
              The passphrase is requested when a key is created or used.

       --oouuttddiirr <<ddiirr>>
              write to directory <dir>

       --ccaahhoosstt <<hhoosstt>>
              define CA hostname (CA master host)

       --ccaaddiirr <<ddiirr>>
              define $CALOCALTOP and $CATOP settings

       --ccaallooccaallttoopp <<ddiirr>>
              define $CALOCALTOP setting

       --ccaattoopp <<ddiirr>>
              define $CATOP setting

       --kkssppwwff <<ffiillee>>
              define a keystore password file that contains a password that is
              used to encrypt the keystore and the keys contained therein

       --kkssoouutt <<ffiillee>>
              define output file to write the keystore to

       --ppkkccss1122ppwwff <<ffiillee>>
              define  a  pkcs12 password file that contains a password that is
              used to encrypt the pkcs12 export file and  the  keys  contained
              therein

       --ppkkccss1122ddiirr <<ddiirr>>
              define  the  output directory <dir> to write the exported pkcs12
              format file to. Otherwise the current working directory is used.

CCOOMMMMAANNDD DDEETTAAIILLSS
       ssggee__ccaa  --iinniitt [[--ccaaddiirr <<ddiirr>>]] [[--ccaattoopp <<ddiirr>>]] [[--ccaallooccaallttoopp <<ddiirr>>]] [[--aaddmmii--
       nnuusseerr <<aaddmmiinn>>]] [[--ddaayyss <<nnuumm ddaayyss>>]]
              The  --iinniitt command creates a new Grid Engine certificate author-
              ity and its corresponding files. Usually "ssggee__ccaa --iinniitt"  is  run
              by  user  root  on  the master host.  If the options -adminuser,
              -cadir, -calocaltop, -catop  and  the  Grid  Engine  environment
              variables SGE_ROOT, SGE_CELL and SGE_QMASTER_PORT are set the CA
              directories are created in the following locations:
              two letter country code,  state,  location,  e.g  city  or  your
              buildingcode,  organization  (e.g. your company name), organiza-
              tional unit, e.g. your  department,  email  address  of  the  CA
              administrator (you!)

              Certificates  and  keys are generated for the CA itself, for SGE
              Daemon, for GE install user (usually root) and finally  for  the
              GE admin user.

              How  and  where  the  certificates  and  keys are created can be
              influenced additionally by:
              --ddaayyss <<ddaayyss>> change the time of validity of the certificates  to
              number of <days> instead of 365 days
              --sshhaa11 change the message digest algorithm from md5 to sha-1
              --eennccrryyppttkkeeyy encrypt the generated keys with a passphrase
              --aaddmmiinnuusseerr <<uusseerr>> use <user> as admin user
              --ccaahhoosstt <<hhoosstt>> use <host> as the CA master host
              [[--ccaaddiirr  <<ddiirr>>]] [[--ccaattoopp <<ddiirr>> [[--ccaallooccaallttoopp <<ddiirr>>]] set $CATOP and
              $CALOCALTOP to <dir> to use something different  than  the  Grid
              Engine default directories. Either -cadir <dir> has to be speci-
              fied to replace $CATOP and $CALOCALTOP by the same directory  or
              -catop <dir> for $CATOP and -calocaltop <dir> for $CALOCALTOP.

       ssggee__ccaa  --uusseerr <<uu::gg::ee>> [[--ccaaddiirr <<ddiirr>>]] [[--ccaattoopp <<ddiirr>>]] [[--ccaallooccaallttoopp <<ddiirr>>]]
       [[--aaddmmiinnuusseerr <<aaddmmiinn>>]] [[--ddaayyss <<ddaayyss>>]]
              generate  certificate  and  keys  for  <u:g:e> with u='Unix user
              account name', g='common name' and e='email address'. By default
              the  certificate  is  valid  for 365 days or by <days> specified
              with -days <days>.  This command is usually run as user root  on
              the  qmaster  host.  $CATOP  and  $CALOCALTOP maybe overruled by
              -cadir, -catop and -calocaltop.

       ssggee__ccaa --ssddmm__ddaaeemmoonn <<uu::gg::ee>>
              generate daemon certificate and keys for  <u:g:e>  with  u='Unix
              user  account  name',  g='common name' and e='email address'. By
              default the certificate is valid for 365 days or by <days> spec-
              ified  with  "--ddaayyss <<ddaayyss>>". This command is usually run as user
              root on the qmaster host.

       ssggee__ccaa --uusseerrcceerrtt <<uusseerr ffiillee>> [[--ccaaddiirr <<ddiirr>>]] [[--ccaattoopp <<ddiirr>>]] [[--ccaallooccaallttoopp
       <<ddiirr>>]] [[--aaddmmiinnuusseerr <<aaddmmiinn>>]] [[--ddaayyss <<ddaayyss>>]] [[--eennccrryyppttkkeeyy]] [[--sshhaa11]]
              Usually sge_ca -usercert <user file> is run as user root on  the
              master  host.  The argument <user file> contains a list of users
              in the following format:

                eddy:Eddy Smith:eddy@griders.org
                sarah:Sarah Miller:sarah@griders.org
                leo:Leo Lion:leo@griders.org

              where the fields separated by colon are:
                Unix user:Gecos field:email address

       ssggee__ccaa --rreenneeww <<uusseerr>> [[--ccaaddiirr <<ddiirr>>]] [[--ccaattoopp <<ddiirr>>]] [[--ccaallooccaallttoopp  <<ddiirr>>]]
       [[--aaddmmiinnuusseerr <<aaddmmiinn>>]] [[--ddaayyss <<ddaayyss>>]]
              Renew the certificate for <user>. By default the certificate  is
              extended  for 365 days or by <days> specified with -days <days>.
              If the value is negative the certificate becomes invalid.   This
              command  is usually run as user root on the qmaster host. $CATOP
              and $CALOCALTOP maybe overruled by -cadir, -catop and  -calocal-
              top.

       ssggee__ccaa  --rreenneeww__ccaa  [[--ccaaddiirr  <<ddiirr>>]]  [[--ccaattoopp  <<ddiirr>>]] [[--ccaallooccaallttoopp <<ddiirr>>]]
       [[--aaddmmiinnuusseerr <<aaddmmiinn>>]] [[--ddaayyss <<ddaayyss>>]]
              Renew the CA certificate. By default the certificate is extended
              for 365 days or by <days> specified with -days  <days>.  If  the
              value is negative the certificate becomes invalid.  This command
              is usually run as user root on  the  qmaster  host.  $CATOP  and
              $CALOCALTOP maybe overruled by -cadir, -catop and -calocaltop.

       ssggee__ccaa  --rreenneeww__ssyyss  [[--ccaaddiirr  <<ddiirr>>]]  [[--ccaattoopp <<ddiirr>>]] [[--ccaallooccaallttoopp <<ddiirr>>]]
       [[--aaddmmiinnuusseerr <<aaddmmiinn>>]] [[--ddaayyss <<ddaayyss>>]]
              Renew  the SGE Daemon certificate. By default the certificate is
              extended for 365 days or by <days> specified with -days  <days>.
              If  the value is negative the certificate becomes invalid.  This
              command is usually run as user root on the qmaster host.  $CATOP
              and  $CALOCALTOP maybe overruled by -cadir, -catop and -calocal-
              top.

       ssggee__ccaa --rreenneeww__ssddmm <<gg>> [[--ccaaddiirr <<ddiirr>>]] [[--ccaattoopp <<ddiirr>>]] [[--ccaallooccaallttoopp <<ddiirr>>]]
       [[--aaddmmiinnuusseerr <<aaddmmiinn>>]] [[--ddaayyss <<ddaayyss>>]]
              Renew the SDM daemon certificate of <g>, where <g> is the common
              name  of  the daemon. By default the certificate is extended for
              365 days or by <days> specified with -days <days>. If the  value
              is  negative  the  certificate becomes invalid.  This command is
              usually run as user root on the qmaster host. $CATOP and  $CALO-
              CALTOP maybe overruled by -cadir, -catop and -calocaltop.

       ssggee__ccaa  --ppkkccss1122  <<uusseerr>>  [[--ppkkccss1122ppwwff <<ffiillee>>]] [[--ppkkccss1122ddiirr <<ddiirr>>]] [[--ccaaddiirr
       <<ddiirr>>]] [[--ccaattoopp <<ddiirr>>]] [[--ccaallooccaallttoopp <<ddiirr>>]] [[--aaddmmiinnuusseerr <<aaddmmiinn>>]]
              export  certificate  and key of user <user> 'the Unix user name'
              in pkcs12 format. This command is usually run as  user  root  on
              the  qmaster host. If -pkcs12pwf <file> is used the file and the
              corresponding key will be encrypted with the password in <file>.
              If  -pkcs12dir  <dir>  is  used  the output file is written into
              <dir>/<user>.p12 instead of ./<user>.p12 . $CATOP and  $CALOCAL-
              TOP maybe overruled by -cadir, -catop and -calocaltop.

       ssggee__ccaa  --ssyyss__ppkkccss1122  [[--ppkkccss1122ppwwff  <<ffiillee>>]]  [[--ppkkccss1122ddiirr  <<ddiirr>>]]  [[--ccaaddiirr
       <<ddiirr>>]] [[--ccaattoopp <<ddiirr>>]] [[--ccaallooccaallttoopp <<ddiirr>>]] [[--aaddmmiinnuusseerr <<aaddmmiinn>>]]
              export  certificate and key of SGE Daemon in pkcs12 format. This
              command is usually run as user root  on  the  qmaster  host.  If
              -pkcs12pwf  <file>  is  used  the file and the corresponding key
              will be encrypted with the password  in  <file>.  If  -pkcs12dir
              <dir>  is  used the output file is written into <dir>/<user>.p12
              instead of ./<user>.p12 . $CATOP and $CALOCALTOP maybe overruled
              by -cadir, -catop and -calocaltop.

       ssggee__ccaa  --ssddmm__ppkkccss1122  <<gg>> [[--ppkkccss1122ppwwff <<ffiillee>>]] [[--ppkkccss1122ddiirr <<ddiirr>>]] [[--ccaaddiirr
       <<ddiirr>>]] [[--ccaattoopp <<ddiirr>>]] [[--ccaallooccaallttoopp <<ddiirr>>]] [[--aaddmmiinnuusseerr <<aaddmmiinn>>]]
              export  certificate  and  key  of  daemon <g> g='common name' in
              pkcs12 format. This command is usually run as user root  on  the
              qmaster host. If -pkcs12pwf <file> is used the file and the cor-
              responding key will be encrypted with the password in <file>. If
              -pkcs12dir  <dir>  is  used  the  output  file  is  written into
              <dir>/<g>.p12 instead of  ./<g>.p12  .  $CATOP  and  $CALOCALTOP
              maybe overruled by -cadir, -catop and -calocaltop.

       ssggee__ccaa  --kkss  <<uusseerr>>  [[--kkssoouutt  <<ffiillee>>]]  [[--kkssppwwff  <<ffiillee>>]]  [[--ccaaddiirr <<ddiirr>>]]
       [[--ccaattoopp <<ddiirr>>]] [[--ccaallooccaallttoopp <<ddiirr>>]] [[--aaddmmiinnuusseerr <<aaddmmiinn>>]]
              create  a keystore containing certificate and key of user <user>
              in JKS format where <user> is the Unix user name.  This  command
              is  usually  run  as  user  root  on the qmaster host. If -kspwf
              <file> is used the keystore and the corresponding  key  will  be
              encrypted  with the password in <file>. The -ksout <file> option
              specifies the keystore file  that  is  created.  If  the  -ksout
              <file>  option  is missing the default location for the keystore
              is $CALOCALTOP/userkeys/<user>/keystore. This command is usually
              invoked  by  sge_ca -userks. A prerequisite is a valid JAVA_HOME
              environment variable setting. $CATOP and $CALOCALTOP maybe over-
              ruled by -cadir, -catop and -calocaltop.

       ssggee__ccaa --uusseerrkkss [[--kkssppwwff <<ffiillee>>]] [[--ccaaddiirr <<ddiirr>>]] [[--ccaattoopp <<ddiirr>>]] [[--ccaallooccaall--
       ttoopp <<ddiirr>>]] [[--aaddmmiinnuusseerr <<aaddmmiinn>>]]
              generate a keystore in JKS format for all users having a key and
              certificate.  This command is usually run as user  root  on  the
              qmaster  host.   If  -kspwf  <file> is used the keystore and the
              corresponding key will be encrypted with the password in <file>.
              The     keystore     files     are    created    in    $CALOCAL-
              TOP/userkeys/<user>/keystore. This command  is  run  after  user
              certificates  and  keys  have been created with sge_ca -usercert
              <userfile> or if any of  the  certificates  have  been  renewed.
              $CATOP  and  $CALOCALTOP  maybe  overruled by -cadir, -catop and
              -calocaltop.

       ssggee__ccaa --ssyysskkss [[--kkssppwwff <<ffiillee>>]] [[--ccaaddiirr <<ddiirr>>]] [[--ccaattoopp <<ddiirr>>]]  [[--ccaallooccaall--
       ttoopp <<ddiirr>>]] [[--aaddmmiinnuusseerr <<aaddmmiinn>>]]
              generate a keystore containing the SGE  Daemon  certificate  and
              key  in JKS format.  This command is usually run as user root on
              the qmaster host.  If -kspwf <file> is used the keystore and the
              corresponding key will be encrypted with the password in <file>.
              The keystore file is  created  in  $CALOCALTOP/private/keystore.
              $CATOP  and  $CALOCALTOP  maybe  overruled by -cadir, -catop and
              -calocaltop.

       ssggee__ccaa --pprriinntt <<cceerrtt>>
              Print a certificate where <cert> is the  corresponding  certifi-
              cate in pem format.

       ssggee__ccaa --pprriinnttkkeeyy <<kkeeyy>>
              Print  a key where <key> is the corresponding key in pem format.

       ssggee__ccaa --pprriinnttccrrll <<ccrrll>>
              Print a certificate revocation list where <crl>  is  the  corre-
              sponding certificate revocation list in pem format.

       ssggee__ccaa --pprriinnttccrrll <<ccrrll>>
              Print  a  certificate  revocation list where <crl> is the corre-
              sponding certificate revocation list in pem format.

       ssggee__ccaa --rreeqq [[--ccaaddiirr <<ddiirr>>]] [[--ccaattoopp <<ddiirr>>]] [[--ccaallooccaallttoopp  <<ddiirr>>]]  [[--aaddmmii--
       nnuusseerr <<aaddmmiinn>>]] [[--ddaayyss <<ddaayyss>>]] [[--eennccrryyppttkkeeyy]] [[--sshhaa11]] [[--oouuttddiirr <<ddiirr>>]]
              create a private key and a certificate request for  the  calling
              user.  This are created as newkey.pem and newreq.pem in the cur-
              rent working directory.  If the option -outdir <dir>  is  speci-
              fied in addition the files are created in <dir>.

       ssggee__ccaa  --ssiiggnn [[--ccaaddiirr <<ddiirr>>]] [[--ccaattoopp <<ddiirr>>]] [[--ccaallooccaallttoopp <<ddiirr>>]] [[--aaddmmii--
       nnuusseerr <<aaddmmiinn>>]] [[--ddaayyss <<ddaayyss>>]] [[--eennccrryyppttkkeeyy]] [[--sshhaa11]] [[--oouuttddiirr <<ddiirr>>
              Sign  a  certificate  request.  The  CA certificate under $CATOP
              (default:  $SGE_ROOT/$SGE_CELL/common/sgeCA)  and  CA  key  from
              $CALOCALTOP         (default:         /var/sgaCA/{port$SGE_QMAS-
              TER_PORT|sge_qmaster}/$SGE_CELL) are used for the signature.  If
              $CATOP  and  $CALOCALTOP  are  set  to a different directory the
              information  there  is  used.  The  certificate  is  created  as
              newcert.pem  in the current working directory or in <dir> if the
              option -outdir <dir> has been specified. In addition the  option
              "--ddaayyss  <<nnuummbbeerr ooff ddaayyss>>" can be specified to change the default
              validity from 365 to number of days.

       ssggee__ccaa --vveerriiffyy <<cceerrtt>> [[--ccaaddiirr <<ddiirr>>]] [[--ccaattoopp <<ddiirr>>]] [[--ccaallooccaallttoopp <<ddiirr>>]]
       [[--aaddmmiinnuusseerr <<aaddmmiinn>>]]
              Verify a certificates validity where <cert> is the corresponding
              certificate  in  pem format. $CATOP and $CALOCALTOP can be over-
              ruled by -cadir, -catop and -calocaltop.

       ssggee__ccaa --ccooppyy [[--ccaaddiirr <<ddiirr>>]] [[--ccaattoopp <<ddiirr>>]] [[--ccaallooccaallttoopp <<ddiirr>>]]
              sge_ca -copy is run by a user to copy the users certificate  and
              key    on   the   master   host   to   $HOME/.sge/port$SGE_QMAS-
              TER_PORT/$SGE_CELL/certs/cert.pem and the corresponding  private
              key      in      $HOME/.sge/port$SGE_QMASTER_PORT/$SGE_CELL/pri-
              vate/key.pem which are used instead of the files in  $CATOP  and
              $CALOCALTOP.  The  command  is only recommended for testing pur-
              poses or where $HOME is on a secure shared file system.

EEXXAAMMPPLLEESS
       # sge_ca -init -cadir /tmp -sha1 -encryptkey -days 31
              create a CA infrastructure in /tmp with a  certificate  validity
              of 31 days using sha-1 instead of md5 as message digest.The keys
              are encrypted and a passphrase has to be entered during the cre-
              ation of the different keys or during signing a certificate with
              the created CA key.

       # sge_ca -usercert /tmp/myusers.txt -cadir /tmp
              /tmp/myusers.txt  contains  user1:My  User:user1@myorg.org   and
              user1 is a valid Unix user account. Create a key and certificate
              for user1.

       # sge_ca -userks -cadir /tmp
              create a keystore for all users of the simple CA.  The  keystore
              is stored under /tmp/userkeys/<user>/keystore.

       # sge_ca -renew root -cadir /tmp -days -1
              make the root certificate temporarily invalid.

       # sge_ca -renew_ca -days 365 -cadir /tmp
              renew the CA certificate for 365 days

EENNVVIIRROONNMMEENNTTAALL VVAARRIIAABBLLEESS
       SSGGEE__RROOOOTT       Specifies  the location of the Grid Engine standard con-
                      figuration files.

       SSGGEE__CCEELLLL       If set, specifies the default Grid Engine cell.

RREESSTTRRIICCTTIIOONNSS
       _s_g_e___c_a The command must be usually called with Grid Engine root permis-
       sions  on the master host.  For more details on the permission require-
       ments consult the  detailed  description  for  the  different  commands
       above.

FFIILLEESS
       ssggee__ccaa  creates  a  file  tree  starting in $$CCAATTOOPP and $$CCAALLOOCCAALLTTOOPP. The
       default for $$CCAATTOOPP is usually $SGE_ROOT/$SGE_CELL/common/sgeCA and  for
       $$CCAALLOOCCAALLTTOOPP    /var/sgeCA/{port$SGE_QMASTER_PORT|sge_qmaster}/$SGE_CELL
       where the subpaths beginning with $ expands to the content of the  cor-
       responding environment variable.

       In  addition  there  may  optionally  exist  the  user  certificate  in
       $HOME/.sge/port$SGE_QMASTER_PORT/$SGE_CELL/certs/cert.pem and the  cor-
       responding      private      key      in      $HOME/.sge/port$SGE_QMAS-
       TER_PORT/$SGE_CELL/private/key.pem which are used instead of the  files
       in $CATOP and $CALOCALTOP. (see sge_ca -copy above)

SSEEEE AALLSSOO
       _g_e___q_m_a_s_t_e_r(8).

CCOOPPYYRRIIGGHHTT
       See _g_e___i_n_t_r_o(1) for a full statement of rights and permissions.



GE 6.2u2                 $Date: 2008/07/19 17:12:58 $                SGE_CA(8)
