NAME

       grid-proxy-init - Generate a new proxy certificate

SYNOPSIS

       grid-proxy-init [-help] [-usage] [-version]

       grid-proxy-init [-debug] [-q] [-verify]
                       [[-valid HOURS:MINUTES] | [-hours HOURS]] [-cert CERTFILE] [-key KEYFILE]
                       [-certdir CERTDIR] [-out PROXYPATH] [-bits BITS]
                       [-policy POLICYFILE]
                       [[-pl POLICY-OID] | [-policy-language POLICY-OID]] [-path-length MAXIMUM]
                       [-pwstdin] [-limited] [-independent] [[-draft] | [-old] | [-rfc]]

DESCRIPTION

       The grid-proxy-init program generates X.509 proxy certificates derived from the currently
       available certificate files. By default, this command generates a RFC 3820[1] Proxy
       Certificate with a 512 bit key valid for 12 hours in a file named /tmp/x509up_uUID.
       Command-line options and variables can modify the format, strength, lifetime, and location
       of the generated proxy certificate.

       X.509 proxy certificates are short-lived certificates, signed usually by a user´s identity
       certificate or another proxy certificate. The key associated with a proxy certificate is
       unencrypted, so applications can authenticate using a proxy identity without providing a
       passphrase.

       Proxy certificates provide a convenient alternative to constantly entering passwords, but
       are also less secure than the user´s normal security credential. Therefore, they should
       always be user-readable only (this is enforced by the GSI libraries), and should be
       deleted after they are no longer needed.

       This version of grid-proxy-init supports three different proxy formats: the old proxy
       format used in early releases of the Globus Toolkit up to version 2.4.x, an IETF draft
       version of X.509 Proxy Certificate profile used in Globus Toolkit 3.0.x and 3.2.x, and the
       RFC 3820 profile used in Globus Toolkit Version 4.0.x and 4.2.x. By default, this version
       of grid-proxy-init creates an RFC 3820 compliant proxy. To create a proxy compatible with
       older versions of the Globus Toolkit, use the -old or -draft command-line options.

       The full set of command-line options to grid-proxy-init are:

       -help, -usage
           Display the command-line options to grid-proxy-init.

       -version
           Display the version number of the grid-proxy-init command

       -debug
           Display information about the path to the certificate and key used to generate the
           proxy certificate, the path to the trusted certificate directory, and verbose error
           messages

       -q
           Suppress all output from grid-proxy-init except for passphrase prompts.

       -verify
           Perform certificate chain validity checks on the generated proxy.

       -valid HOURS:MINUTES, -hours HOURS
           Create a certificate that is valid for HOURS hours and MINUTES minutes. If not
           specified, the default of twelve hours and no minutes is used.

       -cert CERTFILE, -key KEYFILE
           Create a proxy certificate signed by the certificate located in CERTFILE using the key
           located in KEYFILE. If not specified the default certificate and key will be used.
           This overrides the values of environment variables described below.

       -certdir CERTDIR
           Search CERTDIR for trusted certificates if verifying the proxy certificate. If not
           specified, the default trusted certificate search path is used. This overrides the
           value of the X509_CERT_DIR environment variable

       -out PROXYPATH
           Write the generated proxy certificate file to PROXYPATH instead of the default path of
           /tmp/x509up_uUID.

       -bits BITS
           When creating the proxy certificate, use a BITS bit key instead of the default 512 bit
           keys.

       -policy POLICYFILE
           Add the certificate policy data described in POLICYFILE as the ProxyCertInfo X.509
           extension to the generated proxy certificate.

       -pl POLICY-OID, -policy-language POLICY-OID
           Set the policy language identifier of the policy data specified by the -policy
           command-line option to the oid specified by the POLICY-OID string.

       -path-length MAXIMUM
           Set the maximum length of the chain of proxies that can be created by the generated
           proxy to MAXIMUM. If not set, the default of an unlimited proxy chain length is used.

       -pwstdin
           Read the private key´s passphrase from stdin instead of reading input from the
           controlling tty. This is useful when scripting grid-proxy-init.

       -limited
           Create a limited proxy. Limited proxies are generally refused by process-creating
           services, but may be used to authorize with other services.

       -independent
           Create an independent proxy. An independent proxy is not treated as an impersonation
           proxy but as a separate identity for authorization purposes.

       -draft
           Create a IETF draft proxy instead of the default RFC 3280-compliant proxy. This type
           of proxy uses a non-standard proxy policy identifier. This might be useful for
           authenticating with older versions of the Globus Toolkit.

       -old
           Create a legacy proxy instead of the default RFC 3280-compliant proxy. This type of
           proxy uses a non-standard method of indicating that the certificate is a proxy and
           whether it is limited. This might be useful for authenticating with older versions of
           the Globus Toolkit.

       -rfc
           Create an RFC 3820-compliant proxy certificate. This is the default for this version
           of grid-proxy-init.

EXAMPLES

       To create a proxy with the default lifetime and format, run the grid-proxy-init program
       with no arguments. For example:

           % grid-proxy-init
           Your identity: /DC=org/DC=example/CN=Joe User
           Enter GRID pass phrase for this identity:
           Creating proxy .................................. Done
           Your proxy is valid until: Thu Mar 18 03:48:05 2010

       To create a stronger proxy that lasts for only 8 hours, use the -hours and -bits
       command-line options to grid-proxy-init. For example:

           % grid-proxy-init -hours 8 -bits 1024
           Your identity: /DC=org/DC=example/CN=Joe User
           Enter GRID pass phrase for this identity:
           Creating proxy .................................. Done
           Your proxy is valid until: Thu Mar 17 23:48:05 2010

ENVIRONMENT VARIABLES

       The following environment variables affect the execution of grid-proxy-init:

       X509_USER_CERT
           Path to the certificate to use as issuer of the new proxy.

       X509_USER_KEY
           Path to the key to use to sign the new proxy.

       X509_CERT_DIR
           Path to the directory containing trusted certifiate certificates and signing policies.

FILES

       The following files affect the execution of grid-proxy-init:

       $HOME/.globus/usercert.pem
           Default path to the certificate to use as issuer of the new proxy.

       $HOME/.globus/userkey.pem
           Default path to the key to use to sign the new proxy.

COMPATIBILITY

       For more information about proxy certificate types and their compatibility in GT, see
       http://dev.globus.org/wiki/Security/ProxyCertTypes.

SEE ALSO

       grid-proxy-destroy(1), grid-proxy-info(1)

AUTHOR

       University of Chicago

NOTES

        1. RFC 3820
           http://www.ietf.org/rfc/rfc3820.txt