globus证书配置
[update]这篇博客只是globus安装过程中极小的一部分。完整详细的安装过程请看：http://blog.csdn.net/jcwKyl/archive/2009/07/18/4360031.aspx
这一篇接着前一篇日志，在前一篇日志中安装好了
globus
后，开始安全方面的配置。所有的东西也都是来自
gt4
安装包解压后的
quickstart.html
文件，这份文件非常详尽、生动地讲解了所有的操作。以下的部分来自于
quickstart.html
的
2.3
节和安装文档的第七章：
http://www.globus.org/toolkit/docs/4.0/admin/docbook/ch07.html#s-simpleca-admin-installing
这之前先说一个非常有用的工具—— tee 。它读取标准输入，然后把读取的东西同时送到标准输出和一个用户指定的文件中。这样小巧但实用的工具使人更愿意用 linux 。因为我在虚拟机中文本模式下不能向上翻页，但是如果把输出重定向一下又会在需要输入时不知所措，所以找到了它。
首先，运行创建脚本创建一个 CA 。 ( 关于 CA 、证书、 PKI 、公钥加密这些概念是网络安全中的基本概念 )
Globus $ $GLOBUS_LOCATION/setup/globus /setup-simple-ca | tee config.log
第二步：运行 setup-gsi 脚本安装 gsi (Grid Security Infrustructure ) 。
因为这一步需要在 /etc 目录下写入数据，所以切换到 root 用户运行这个脚本。
$ su
#$GLOBUS_LOCATION/setup/globus_simple_ca_2bebede3_setup/setup-gsi –default | tee config.log
第三步：创建主机的证书。
因为要写 /etc ，所以仍然需要以 root 身份运行命令。
#source /usr/local/globus-4.0.8/etc/globus-user-env.sh
#grid-cert-request –host `hostname`
第四步：为主机的证书签名。 ( 猜测这应该是用 CA 的 private key 来加密上述 hostcert_request.pem 文件 )
#exit
$source $GLOBUS_LOCATION/etc/globus-user-env.sh
$grid-ca-sign –in /etc/grid-security/hostcert_request.pem –out hostsigned.pem
$su
#cp hostsigned.pem /etc/grid-security/hostcert.pem
第五步：为用户创建证书。 这里的用户不是指 globus,root 是超级用户 ,globus 用户用来管理 globus ，我们再创建一个普通用户 guest, 它用来使用这些服务。使用 guest 登录系统。
Guest$ source /usr/local/globus-4.0.8/etc/globus-user-env.sh
Guest$ grid-cert-request
第六步：让 CA 为用户签名从而生成用户的证书。 因为 CA 的所有者是 globus 用户 (globus 用户专门负责管理 globus 的 ) ，所以签名需要切换到 globus 的身份来进行。
Guest$ cd /home
Guest$ chmod –R o+X guest
这两条命令是为了能让 globus 用户读到 guest 用户的 usercert.pem 文件。
Guest$ su globus
Globus $ grid-ca-sign –in /home/guest/.globus/usercert_request.pem –out signed.pem
Globus $ cd /home
Globus $ chmod –R o+X globus
Globus $ exit
Guest$ cd .globus
Guest$ cp /home/globus/signed.pem usercert.pem
我们可以看一下签名证书是什么内容：
Guest$ cat usercert.pem
文档的最后部分是在多机环境中配置 CA 认证，在另一台电脑上再次安装太耗时，就不在测试了。
最后，
第七步：验证以上步骤是否正确执行。
guest $ grid-proxy-init -debug -verify
http://www.globus.org/toolkit/docs/4.0/admin/docbook/ch07.html#s-simpleca-admin-installing
这之前先说一个非常有用的工具—— tee 。它读取标准输入，然后把读取的东西同时送到标准输出和一个用户指定的文件中。这样小巧但实用的工具使人更愿意用 linux 。因为我在虚拟机中文本模式下不能向上翻页，但是如果把输出重定向一下又会在需要输入时不知所措，所以找到了它。
首先，运行创建脚本创建一个 CA 。 ( 关于 CA 、证书、 PKI 、公钥加密这些概念是网络安全中的基本概念 )
Globus $ $GLOBUS_LOCATION/setup/globus /setup-simple-ca | tee config.log
WARNING: GPT_LOCATION not set, assuming:
GPT_LOCATION=/usr/local/globus-4.0.8
C e r t i f i c a t e A u t h o r i t y S e t u p
This script will setup a Certificate Authority for signing Globus
users certificates. It will also generate a simple CA package
that can be distributed to the users of the CA.
The CA information about the certificates it distributes will
be kept in:
/home/globus/.globus/simpleCA /
The unique subject name for this CA is:
cn = Globus Simple CA, ou =simpleCA-jcwkyl , ou =GlobusTest , o=Grid
Do you want to keep this as the CA subject (y/n) [y]:
Enter the email of the CA (this is the email where certificate
requests will be sent to be signed by the CA):
The CA certificate has an expiration date. Keep in mind that
once the CA certificate has expired, all the certificates
signed by that CA become invalid. A CA should regenerate
the CA certificate and start re-issuing ca-setup packages
before the actual CA certificate expires. This can be done
by re-running this setup script. Enter the number of DAYS
the CA certificate should last before it expires.
[default : 5 years (1825 days)]:
[H [J
creating CA config package...done.
A self-signed certificate has been generated
for the Certificate Authority with the subject:
/O=Grid/OU=GlobusTest /OU=simpleCA-jcwkyl/CN =Globus Simple CA
If this is invalid, rerun this script
/usr/local/globus-4.0.8/setup/globus/setup-simple-ca
and enter the appropriate fields.
-------------------------------------------------------------------
The private key of the CA is stored in /home/globus/.globus/simpleCA//private/cakey.pem
The public CA certificate is stored in /home/globus/.globus/simpleCA//cacert.pem
The distribution package built for this CA is stored in
/home/globus/.globus/simpleCA//globus_simple_ca_2bebede3_setup-0.19.tar.gz
This file must be distributed to any host wishing to request
certificates from this CA.
CA setup complete.
The following commands will now be run to setup the security
configuration files for this CA:
$GLOBUS_LOCATION/sbin/gpt -build /home/globus/.globus/simpleCA//globus_simple_ca_2bebede3_setup-0.19.tar.gz
$GLOBUS_LOCATION/sbin/gpt-postinstall
-------------------------------------------------------------------
setup-ssl-utils : Configuring ssl-utils package
Running setup-ssl-utils-sh-scripts ...
***************************************************************************
Note: To complete setup of the GSI software you need to run the
following script as root to configure your security configuration
directory :
/usr/local/globus-4.0.8/setup/globus_simple_ca_2bebede3_setup/setup-gsi
For further information on using the setup-gsi script, use the -help
option . The -default option sets this security configuration to be
the default, and -nonroot can be used on systems where root access is
not available.
***************************************************************************
setup-ssl-utils : Complete
GPT_LOCATION=/usr/local/globus-4.0.8
C e r t i f i c a t e A u t h o r i t y S e t u p
This script will setup a Certificate Authority for signing Globus
users certificates. It will also generate a simple CA package
that can be distributed to the users of the CA.
The CA information about the certificates it distributes will
be kept in:
/home/globus/.globus/simpleCA /
The unique subject name for this CA is:
cn = Globus Simple CA, ou =simpleCA-jcwkyl , ou =GlobusTest , o=Grid
Do you want to keep this as the CA subject (y/n) [y]:
Enter the email of the CA (this is the email where certificate
requests will be sent to be signed by the CA):
The CA certificate has an expiration date. Keep in mind that
once the CA certificate has expired, all the certificates
signed by that CA become invalid. A CA should regenerate
the CA certificate and start re-issuing ca-setup packages
before the actual CA certificate expires. This can be done
by re-running this setup script. Enter the number of DAYS
the CA certificate should last before it expires.
[default : 5 years (1825 days)]:
[H [J
creating CA config package...done.
A self-signed certificate has been generated
for the Certificate Authority with the subject:
/O=Grid/OU=GlobusTest /OU=simpleCA-jcwkyl/CN =Globus Simple CA
If this is invalid, rerun this script
/usr/local/globus-4.0.8/setup/globus/setup-simple-ca
and enter the appropriate fields.
-------------------------------------------------------------------
The private key of the CA is stored in /home/globus/.globus/simpleCA//private/cakey.pem
The public CA certificate is stored in /home/globus/.globus/simpleCA//cacert.pem
The distribution package built for this CA is stored in
/home/globus/.globus/simpleCA//globus_simple_ca_2bebede3_setup-0.19.tar.gz
This file must be distributed to any host wishing to request
certificates from this CA.
CA setup complete.
The following commands will now be run to setup the security
configuration files for this CA:
$GLOBUS_LOCATION/sbin/gpt -build /home/globus/.globus/simpleCA//globus_simple_ca_2bebede3_setup-0.19.tar.gz
$GLOBUS_LOCATION/sbin/gpt-postinstall
-------------------------------------------------------------------
setup-ssl-utils : Configuring ssl-utils package
Running setup-ssl-utils-sh-scripts ...
***************************************************************************
Note: To complete setup of the GSI software you need to run the
following script as root to configure your security configuration
directory :
/usr/local/globus-4.0.8/setup/globus_simple_ca_2bebede3_setup/setup-gsi
For further information on using the setup-gsi script, use the -help
option . The -default option sets this security configuration to be
the default, and -nonroot can be used on systems where root access is
not available.
***************************************************************************
setup-ssl-utils : Complete
第二步：运行 setup-gsi 脚本安装 gsi (Grid Security Infrustructure ) 。
因为这一步需要在 /etc 目录下写入数据，所以切换到 root 用户运行这个脚本。
$ su
#$GLOBUS_LOCATION/setup/globus_simple_ca_2bebede3_setup/setup-gsi –default | tee config.log
setup-gsi
: Configuring GSI security
Making /etc/grid-security...
mkdir /etc/grid-security
Making trusted certs directory: /etc/grid-security/certificates/
mkdir /etc/grid-security/certificates/
Installing /etc/grid-security/certificates//grid-security.conf.2bebede3...
Running grid-security-config ...
Installing Globus CA certificate into trusted CA certificate directory...
Installing Globus CA signing policy into trusted CA certificate directory...
setup-gsi : Complete
Making /etc/grid-security...
mkdir /etc/grid-security
Making trusted certs directory: /etc/grid-security/certificates/
mkdir /etc/grid-security/certificates/
Installing /etc/grid-security/certificates//grid-security.conf.2bebede3...
Running grid-security-config ...
Installing Globus CA certificate into trusted CA certificate directory...
Installing Globus CA signing policy into trusted CA certificate directory...
setup-gsi : Complete
第三步：创建主机的证书。
因为要写 /etc ，所以仍然需要以 root 身份运行命令。
#source /usr/local/globus-4.0.8/etc/globus-user-env.sh
#grid-cert-request –host `hostname`
A private host key and a certificate request has been generated
with the subject:
/O=Grid/OU=GlobusTest /OU=simpleCA-jcwkyl/CN =host/jcwkyl
----------------------------------------------------------
The private key is stored in /etc/grid-security/hostkey.pem
The request is stored in /etc/grid-security/hostcert_request.pem
Please e-mail the request to the Globus Simple CA [email protected]
You may use a command similar to the following:
cat /etc/grid-security/hostcert_request.pem | mail [email protected]
Only use the above if this machine can send AND receive e-mail. if not, please
mail using some other method.
Your certificate will be mailed to you within two working days.
If you receive no response, contact Globus Simple CA at [email protected]
可以用
cat
命令查看
hostkey.pem
, hostcert.pem , hostcert_request.pem
三个文件，发现第一个文件是密钥，第二个文件是空文件，第三个文件中有一些提示信息以及
REQUEST
部分。
with the subject:
/O=Grid/OU=GlobusTest /OU=simpleCA-jcwkyl/CN =host/jcwkyl
----------------------------------------------------------
The private key is stored in /etc/grid-security/hostkey.pem
The request is stored in /etc/grid-security/hostcert_request.pem
Please e-mail the request to the Globus Simple CA [email protected]
You may use a command similar to the following:
cat /etc/grid-security/hostcert_request.pem | mail [email protected]
Only use the above if this machine can send AND receive e-mail. if not, please
mail using some other method.
Your certificate will be mailed to you within two working days.
If you receive no response, contact Globus Simple CA at [email protected]
第四步：为主机的证书签名。 ( 猜测这应该是用 CA 的 private key 来加密上述 hostcert_request.pem 文件 )
#exit
$source $GLOBUS_LOCATION/etc/globus-user-env.sh
$grid-ca-sign –in /etc/grid-security/hostcert_request.pem –out hostsigned.pem
To sign the request
please enter the password for the CA key:
The new signed certificate is at: /home/globus/.globus/simpleCA//newcerts/01.pem
把生成的
hostsigned.pem
文件剪贴到
/etc/grid-security/hostcert.pem
中
(
安装文档要求
)
，也就是说，签过名的这个文件就成为主机的证书，主机的密钥在
hostkey.pem
文件中。
please enter the password for the CA key:
The new signed certificate is at: /home/globus/.globus/simpleCA//newcerts/01.pem
$su
#cp hostsigned.pem /etc/grid-security/hostcert.pem
第五步：为用户创建证书。 这里的用户不是指 globus,root 是超级用户 ,globus 用户用来管理 globus ，我们再创建一个普通用户 guest, 它用来使用这些服务。使用 guest 登录系统。
Guest$ source /usr/local/globus-4.0.8/etc/globus-user-env.sh
Guest$ grid-cert-request
A certificate request and private key is being created.
You will be asked to enter a PEM pass phrase.
This pass phrase is akin to your account password,
and is used to protect your key file.
If you forget your pass phrase, you will need to
obtain a new certificate.
A private key and a certificate request has been generated with the subject:
/O=Grid/OU=GlobusTest /OU=simpleCA-jcwkyl/CN =guest
If the CN=guest is not appropriate, rerun this
script with the -force -cn "Common Name" options.
Your private key is stored in /home/guest/.globus/userkey.pem
Your request is stored in /home/guest/.globus/usercert_request.pem
Please e-mail the request to the Globus Simple CA [email protected]
You may use a command similar to the following:
cat /home/guest/.globus/usercert_request.pem | mail [email protected]
Only use the above if this machine can send AND receive e-mail. if not, please
mail using some other method.
Your certificate will be mailed to you within two working days.
If you receive no response, contact Globus Simple CA at [email protected]
与主机一样，用户需要让
CA
为他签名才能得到用户自己的证书，所以很自然地，下一步就是让
CA
为用户签名。
You will be asked to enter a PEM pass phrase.
This pass phrase is akin to your account password,
and is used to protect your key file.
If you forget your pass phrase, you will need to
obtain a new certificate.
A private key and a certificate request has been generated with the subject:
/O=Grid/OU=GlobusTest /OU=simpleCA-jcwkyl/CN =guest
If the CN=guest is not appropriate, rerun this
script with the -force -cn "Common Name" options.
Your private key is stored in /home/guest/.globus/userkey.pem
Your request is stored in /home/guest/.globus/usercert_request.pem
Please e-mail the request to the Globus Simple CA [email protected]
You may use a command similar to the following:
cat /home/guest/.globus/usercert_request.pem | mail [email protected]
Only use the above if this machine can send AND receive e-mail. if not, please
mail using some other method.
Your certificate will be mailed to you within two working days.
If you receive no response, contact Globus Simple CA at [email protected]
第六步：让 CA 为用户签名从而生成用户的证书。 因为 CA 的所有者是 globus 用户 (globus 用户专门负责管理 globus 的 ) ，所以签名需要切换到 globus 的身份来进行。
Guest$ cd /home
Guest$ chmod –R o+X guest
这两条命令是为了能让 globus 用户读到 guest 用户的 usercert.pem 文件。
Guest$ su globus
Globus $ grid-ca-sign –in /home/guest/.globus/usercert_request.pem –out signed.pem
To sign the request
please enter the password for the CA key:
The new signed certificate is at: /home/globus/.globus/simpleCA//newcerts/02.pem
结合主机证书的生成过程，这一步当然是要把生成的签名证书复制到
guest
用户的目录中。
please enter the password for the CA key:
The new signed certificate is at: /home/globus/.globus/simpleCA//newcerts/02.pem
Globus $ cd /home
Globus $ chmod –R o+X globus
Globus $ exit
Guest$ cd .globus
Guest$ cp /home/globus/signed.pem usercert.pem
我们可以看一下签名证书是什么内容：
Guest$ cat usercert.pem
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 2 (0x2)
Signature Algorithm: md5WithRSAEncryption
Issuer: O=Grid, OU=GlobusTest , OU=simpleCA-jcwkyl , CN=Globus Simple CA
Validity
Not Before: Jul 4 11:48:32 2009 GMT
Not After : Jul 4 11:48:32 2010 GMT
Subject: O=Grid, OU=GlobusTest , OU=simpleCA-jcwkyl , CN=guest
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public Key: (1024 bit)
Modulus (1024 bit):
00:c1:e3:f0:aa:49:5a:00:70:74:22:f1:c7:47:e9 :
3d:b1:2c:ec:92:9f:b4:4e:3f:e0:f2:7e:46:97:90 :
24:90:1a:50:79:70:33:d7:51:4b:8a:1d:92:33:0e :
93:d2:1e:28:0d:e7:df:3a:4c:7e:32:35:f6:8c:9b :
17:0d:81:f2:f9:0d:1e:1d:d5:ee:d6:45:1e:24:f5 :
dd: b1:30:e0:a5:32:53:f6:39:b8:51:47:83:01:dc:
40:90:f3:14:fd:f4:35:92:60:fa:be:f0:85:fd:59:
1f:08:44:2c:db:b8:3a:7f:4b:87:0e:a0:3a:1a:61 :
92:28:15:36:e2:62:ea:5d:21
Exponent: 65537 (0x10001)
X509v3 extensions:
Netscape Cert Type:
SSL Client, SSL Server, S/MIME, Object Signing
Signature Algorithm: md5WithRSAEncryption
97:b3:0a:f2:20:cd:b6:dc:b1:82:11:1b:f2:32:42:ff:e5:c4 :
ea: e7:96:c1:5f:46:a7:56:38:09:d3:63:b6:40:87:09:80:be:
b9:92:f6:72:b7:41:9b:24:07:4f:56:44:91:c2:7b:49:9d:be :
72:94:d2:c9:dd:e9:65:2b:c2:22:f8:16:91:b8:69:ce:fd:1a :
51:83:63:92:d8:db:a2:04:7f:bc:d7:43:85:43:4c:31:16:4a :
d3:92:9a:4a:d2:f0:ec:81:81:a7:f7:bc:f9:0a:1d:c6:25:10 :
c5:2b:e1:b0:7e:88:48:d0:07:b9:69:d1:78:6e:9b:00:27:da :
3f:5a
-----BEGIN CERTIFICATE-----
MIICMjCCAZugAwIBAgIBAjANBgkqhkiG9w0BAQQFADBZMQ0wCwYDVQQKEwRHcmlk
MRMwEQYDVQQLEwpHbG9idXNUZXN0MRgwFgYDVQQLEw9zaW1wbGVDQS1qY3dreWwx
GTAXBgNVBAMTEEdsb2J1cyBTaW1wbGUgQ0EwHhcNMDkwNzA0MTE0ODMyWhcNMTAw
NzA0MTE0ODMyWjBOMQ0wCwYDVQQKEwRHcmlkMRMwEQYDVQQLEwpHbG9idXNUZXN0
MRgwFgYDVQQLEw9zaW1wbGVDQS1qY3dreWwxDjAMBgNVBAMTBWd1ZXN0MIGfMA0G
CSqGSIb3DQEBAQUAA4GNADCBiQKBgQDB4/CqSVoAcHQi8cdH6T2xLOySn7ROP+Dy
fkaXkCSQGlB5cDPXUUuKHZIzDpPSHigN5986TH4yNfaMmxcNgfL5DR4d1e7WRR4k
9d2xMOClMlP2ObhRR4MB3ECQ8xT99DWSYPq+8IX9WR8IRCzbuDp/S4cOoDoaYZIo
FTbiYupdIQIDAQABoxUwEzARBglghkgBhvhCAQEEBAMCBPAwDQYJKoZIhvcNAQEE
BQADgYEAl7MK8iDNttyxghEb8jJC/+XE6ueWwV9Gp1Y4CdNjtkCHCYC+uZL2crdB
myQHT1ZEkcJ7SZ2+cpTSyd3pZSvCIvgWkbhpzv0aUYNjktjbogR/vNdDhUNMMRZK
05KaStLw7IGBp/e8+QodxiUQxSvhsH6ISNAHuWnReG6bACfaP1o=
-----END CERTIFICATE-----
Data:
Version: 3 (0x2)
Serial Number: 2 (0x2)
Signature Algorithm: md5WithRSAEncryption
Issuer: O=Grid, OU=GlobusTest , OU=simpleCA-jcwkyl , CN=Globus Simple CA
Validity
Not Before: Jul 4 11:48:32 2009 GMT
Not After : Jul 4 11:48:32 2010 GMT
Subject: O=Grid, OU=GlobusTest , OU=simpleCA-jcwkyl , CN=guest
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public Key: (1024 bit)
Modulus (1024 bit):
00:c1:e3:f0:aa:49:5a:00:70:74:22:f1:c7:47:e9 :
3d:b1:2c:ec:92:9f:b4:4e:3f:e0:f2:7e:46:97:90 :
24:90:1a:50:79:70:33:d7:51:4b:8a:1d:92:33:0e :
93:d2:1e:28:0d:e7:df:3a:4c:7e:32:35:f6:8c:9b :
17:0d:81:f2:f9:0d:1e:1d:d5:ee:d6:45:1e:24:f5 :
dd: b1:30:e0:a5:32:53:f6:39:b8:51:47:83:01:dc:
40:90:f3:14:fd:f4:35:92:60:fa:be:f0:85:fd:59:
1f:08:44:2c:db:b8:3a:7f:4b:87:0e:a0:3a:1a:61 :
92:28:15:36:e2:62:ea:5d:21
Exponent: 65537 (0x10001)
X509v3 extensions:
Netscape Cert Type:
SSL Client, SSL Server, S/MIME, Object Signing
Signature Algorithm: md5WithRSAEncryption
97:b3:0a:f2:20:cd:b6:dc:b1:82:11:1b:f2:32:42:ff:e5:c4 :
ea: e7:96:c1:5f:46:a7:56:38:09:d3:63:b6:40:87:09:80:be:
b9:92:f6:72:b7:41:9b:24:07:4f:56:44:91:c2:7b:49:9d:be :
72:94:d2:c9:dd:e9:65:2b:c2:22:f8:16:91:b8:69:ce:fd:1a :
51:83:63:92:d8:db:a2:04:7f:bc:d7:43:85:43:4c:31:16:4a :
d3:92:9a:4a:d2:f0:ec:81:81:a7:f7:bc:f9:0a:1d:c6:25:10 :
c5:2b:e1:b0:7e:88:48:d0:07:b9:69:d1:78:6e:9b:00:27:da :
3f:5a
-----BEGIN CERTIFICATE-----
MIICMjCCAZugAwIBAgIBAjANBgkqhkiG9w0BAQQFADBZMQ0wCwYDVQQKEwRHcmlk
MRMwEQYDVQQLEwpHbG9idXNUZXN0MRgwFgYDVQQLEw9zaW1wbGVDQS1qY3dreWwx
GTAXBgNVBAMTEEdsb2J1cyBTaW1wbGUgQ0EwHhcNMDkwNzA0MTE0ODMyWhcNMTAw
NzA0MTE0ODMyWjBOMQ0wCwYDVQQKEwRHcmlkMRMwEQYDVQQLEwpHbG9idXNUZXN0
MRgwFgYDVQQLEw9zaW1wbGVDQS1qY3dreWwxDjAMBgNVBAMTBWd1ZXN0MIGfMA0G
CSqGSIb3DQEBAQUAA4GNADCBiQKBgQDB4/CqSVoAcHQi8cdH6T2xLOySn7ROP+Dy
fkaXkCSQGlB5cDPXUUuKHZIzDpPSHigN5986TH4yNfaMmxcNgfL5DR4d1e7WRR4k
9d2xMOClMlP2ObhRR4MB3ECQ8xT99DWSYPq+8IX9WR8IRCzbuDp/S4cOoDoaYZIo
FTbiYupdIQIDAQABoxUwEzARBglghkgBhvhCAQEEBAMCBPAwDQYJKoZIhvcNAQEE
BQADgYEAl7MK8iDNttyxghEb8jJC/+XE6ueWwV9Gp1Y4CdNjtkCHCYC+uZL2crdB
myQHT1ZEkcJ7SZ2+cpTSyd3pZSvCIvgWkbhpzv0aUYNjktjbogR/vNdDhUNMMRZK
05KaStLw7IGBp/e8+QodxiUQxSvhsH6ISNAHuWnReG6bACfaP1o=
-----END CERTIFICATE-----
文档的最后部分是在多机环境中配置 CA 认证，在另一台电脑上再次安装太耗时，就不在测试了。
最后，
第七步：验证以上步骤是否正确执行。
guest $ grid-proxy-init -debug -verify
User Cert File: /home/guest/.globus/usercert.pem
User Key File: /home/guest/.globus/userkey.pem
Trusted CA Cert Dir: /etc/grid-security/certificates
Output File: /tmp/x509up_u501
Your identity: /O=Grid/OU=GlobusTest /OU=simpleCA-jcwkyl/CN =guest
Enter GRID pass phrase for this identity:
Creating proxy .+ +++++++++++
......++++++++++++
Done
Proxy Verify OK
Your proxy is valid until: Sat Jul 4 20:11:27 2009
Your identity: /O=Grid/OU=GlobusTest /OU=simpleCA-jcwkyl/CN =guest
Creating proxy ...............++++++++++++
.....++++++++++++
Done
Your proxy is valid until: Sat Jul 4 20:10:29 2009
User Key File: /home/guest/.globus/userkey.pem
Trusted CA Cert Dir: /etc/grid-security/certificates
Output File: /tmp/x509up_u501
Your identity: /O=Grid/OU=GlobusTest /OU=simpleCA-jcwkyl/CN =guest
Enter GRID pass phrase for this identity:
Creating proxy .+ +++++++++++
......++++++++++++
Done
Proxy Verify OK
Your proxy is valid until: Sat Jul 4 20:11:27 2009
Your identity: /O=Grid/OU=GlobusTest /OU=simpleCA-jcwkyl/CN =guest
Creating proxy ...............++++++++++++
.....++++++++++++
Done
Your proxy is valid until: Sat Jul 4 20:10:29 2009