Whole site: Host certificate update

Introduction

Updating the host certificate in /etc/grid-security is not always sufficient: some services have a copy of this certificate which they started with. It is therefore necessary to update those copies and restart these services.

For an automatic update using the YAIM configuration tool:

• update host certificates under /etc/grid-security directory
• reconfigure the whole node using YAIM, not forgetting to use all services (node-types) that need to be mentioned as arguments of the command line.

For a manual configuration please follow the advices bellow:

• find all locations where you have put copies of the host cert & key files
• ensure the right ownership and permissions are maintained
• restart specific services

List of known paths and ownerships for individual services:

• Copies of certificate shold have the following permissions:
  • 644 for public key (hostcert.pem)
  • 600 for the private key (hostkey.pem)
• Generally you can easily find the location using locate unix command:
  

  locate cert.pem
  locate key.pem

This will help in case paths have changes between different versions of the same service or they are different between different services. For example you can find also: tomcat-cert.pem & tomcat-key.pem

Please find bellow details for specific services:

• CREAM CE:
  

  # ll /etc/grid-security/*.pem
  -rw-r--r-- 1 root   root 1428 Oct 22 10:19 /etc/grid-security/hostcert.pem
  -r-------- 1 root   root  887 Oct 22 10:19 /etc/grid-security/hostkey.pem
  -rw-r--r-- 1 tomcat root 1428 Nov 12 16:01 /etc/grid-security/tomcat-cert.pem
  -r-------- 1 tomcat root  887 Nov 12 16:01 /etc/grid-security/tomcat-key.pem

  • and, depending on the glite user home directory:
    

    # ll /var/glite/.certs/*.pem
    -rw-r--r-- 1 glite glite 1419 Dec 13 12:00 /var/glite/.certs/hostcert.pem
    -r-------- 1 glite glite  887 Dec  5 16:59 /var/glite/.certs/hostkey.pem

  • OR
    

    # ll /home/glite/.certs/*.pem
    -rw-r--r-- 1 glite glite 1428 Dec 13 12:00 /home/glite/.certs/hostcert.pem
    -r-------- 1 glite glite  887 Nov 12 16:03 /home/glite/.certs/hostkey.pem

Services to be restarted

CREAM-CE

• tomcat5 for SL5
• tomcat6 for SL6
• globus-gridftp
• glite-lb-locallogger

lcg-CE

• globus-gatekeeper
• globus-gridftp

SE StoRM

• storm-backend, storm-frontend, storm-checksum
• globus-gridftp

SE DPM

• dpm, dpmcopyd, dpm-gsiftp, dpm-httpd, dpnsdaemon
• srmv1, srmv2, srmv2.2
• globus-gridftp

VOMS

• tomcat5
• voms

WMS

• gLite