Command Line Tool for Certificate Management Anand Padmanabhan - PowerPoint PPT Presentation

Purpose vdt-ca-manage Tool Demo Conclusion Command Line Tool for Certificate Management Anand Padmanabhan CyberInfrastructure and Geospatial Information Laboratory (CIGI) National Center for Supercomputing Applications University of Illinois at Urbana-Champaign OSG Site Administrators Meeting Nov 13, 2008 Anand Padmanabhan vdt-ca-manage

Purpose vdt-ca-manage Tool Demo Conclusion Purpose of developing CA Manage tool You need to the CA certificates for users to run jobs Facilitate management of CAs and CRLs Provide functionality to inspect verify manage CAs and CRLs installed at your site Provide a single interface to manage certificates Work with CE or worker node installations Anand Padmanabhan vdt-ca-manage

Purpose vdt-ca-manage Tool Syntax Demo Commands Conclusion Command Syntax vdt-ca-manage [global_options] command global_options = [--vdt-location <location>] [--verbose] [--force] [--certDir <location>] [--help] [--version] [--autoRefresh] command = [status_command | manage_command] [<command_options>] Anand Padmanabhan vdt-ca-manage

Purpose vdt-ca-manage Tool Syntax Demo Commands Conclusion Status Commands showCAURL: Outputs the current CA distribution location. Anand Padmanabhan vdt-ca-manage

Purpose vdt-ca-manage Tool Syntax Demo Commands Conclusion Status Commands showCAURL: Outputs the current CA distribution location. listCA [–pattern <pattern>]: Lists all the CAs (in cert dir) that match the provided pattern. Anand Padmanabhan vdt-ca-manage

Purpose vdt-ca-manage Tool Syntax Demo Commands Conclusion Status Commands showCAURL: Outputs the current CA distribution location. listCA [–pattern <pattern>]: Lists all the CAs (in cert dir) that match the provided pattern. verify [–hash <hash> |–pattern <pattern>]: Checks the CA and CRL files of the specified/all CAs to verify they are valid (using openssl command). It also gives a warning if any CA or CRL are close to expiration. Anand Padmanabhan vdt-ca-manage

Purpose vdt-ca-manage Tool Syntax Demo Commands Conclusion Status Commands showCAURL: Outputs the current CA distribution location. listCA [–pattern <pattern>]: Lists all the CAs (in cert dir) that match the provided pattern. verify [–hash <hash> |–pattern <pattern>]: Checks the CA and CRL files of the specified/all CAs to verify they are valid (using openssl command). It also gives a warning if any CA or CRL are close to expiration. diffCAPackage: Prints the difference between CAs present in the certificate directory and the latest distribution from VDT/OSG. Anand Padmanabhan vdt-ca-manage

Purpose vdt-ca-manage Tool Syntax Demo Commands Conclusion Status Commands showCAURL: Outputs the current CA distribution location. listCA [–pattern <pattern>]: Lists all the CAs (in cert dir) that match the provided pattern. verify [–hash <hash> |–pattern <pattern>]: Checks the CA and CRL files of the specified/all CAs to verify they are valid (using openssl command). It also gives a warning if any CA or CRL are close to expiration. diffCAPackage: Prints the difference between CAs present in the certificate directory and the latest distribution from VDT/OSG. show [–certfile <cert>|–hash <hash>]: Prints the details of certificate using openssl x509 command. Anand Padmanabhan vdt-ca-manage

Purpose vdt-ca-manage Tool Syntax Demo Commands Conclusion Status Commands showCAURL: Outputs the current CA distribution location. listCA [–pattern <pattern>]: Lists all the CAs (in cert dir) that match the provided pattern. verify [–hash <hash> |–pattern <pattern>]: Checks the CA and CRL files of the specified/all CAs to verify they are valid (using openssl command). It also gives a warning if any CA or CRL are close to expiration. diffCAPackage: Prints the difference between CAs present in the certificate directory and the latest distribution from VDT/OSG. show [–certfile <cert>|–hash <hash>]: Prints the details of certificate using openssl x509 command. showChain [–certfile <cert>|–hash <hash>]: Outputs the trust chain of the certificate. Anand Padmanabhan vdt-ca-manage

Purpose vdt-ca-manage Tool Syntax Demo Commands Conclusion Manage Commands refreshCA: Downloads CA package from distribution URL as necessary. (uses vdt-update-certs) Anand Padmanabhan vdt-ca-manage

Purpose vdt-ca-manage Tool Syntax Demo Commands Conclusion Manage Commands refreshCA: Downloads CA package from distribution URL as necessary. (uses vdt-update-certs) fetchCRL: Download the latest CRL packages. (uses fetch-crl) Anand Padmanabhan vdt-ca-manage

Purpose vdt-ca-manage Tool Syntax Demo Commands Conclusion Manage Commands refreshCA: Downloads CA package from distribution URL as necessary. (uses vdt-update-certs) fetchCRL: Download the latest CRL packages. (uses fetch-crl) setCAURL [–url <URLlocation>]: Update the CA distribution URL. Anand Padmanabhan vdt-ca-manage

Purpose vdt-ca-manage Tool Syntax Demo Commands Conclusion Manage Commands refreshCA: Downloads CA package from distribution URL as necessary. (uses vdt-update-certs) fetchCRL: Download the latest CRL packages. (uses fetch-crl) setCAURL [–url <URLlocation>]: Update the CA distribution URL. add [–dir <localdir>] –hash <hash>: Adds either a new local CA or a previously removed CA. Anand Padmanabhan vdt-ca-manage

Purpose vdt-ca-manage Tool Syntax Demo Commands Conclusion Manage Commands refreshCA: Downloads CA package from distribution URL as necessary. (uses vdt-update-certs) fetchCRL: Download the latest CRL packages. (uses fetch-crl) setCAURL [–url <URLlocation>]: Update the CA distribution URL. add [–dir <localdir>] –hash <hash>: Adds either a new local CA or a previously removed CA. remove –hash <hash>: Remove either a CA coming from the distribution or a previously included local CA. Anand Padmanabhan vdt-ca-manage

Purpose vdt-ca-manage Tool Demo Conclusion Demo Brief Demo Anand Padmanabhan vdt-ca-manage

Purpose vdt-ca-manage Tool Demo Conclusion Conclusion Highlights Useful tool to manage your certificate directory. A unified interface to Add, remove, and update CAs Lookup CAs based on pattern or hash Lookup the trust chain of any certificate Drawbacks Will not work for sites using yum/rpms to manage CAs Dependent on vdt-update-certs, fetch-crl Reference https://twiki.grid.iu.edu/bin/view/Security/CAMgmtCommandLineTool Anand Padmanabhan vdt-ca-manage