How to get a Grid Certificate

Before submitting jobs to the Grid, you must have a valid grid certificate. For that purpose, you need to request a certificate from your country's Certification Authority (CA), a list of which can be found here . When you arrive at your CA's site then follow the instructions. Once the local representative has approved your request, you will follow instructions explaining how to import the certificate. You must use the same computer to do all these steps as you used to make the request.

Now, do the following:

• 1. Go to the "certifcates" settings on your browser (probably in preferences or internet options, depending on the browser). You need to "export" the certificate to your hard drive. You will be asked to input various passwords - don't forget them! Also, make sure you remember where your certificate is saved to.
  
• 2. The end result of this will be that you get a key pair (which is a single file with the extension .pfx or .p12) in your hard drive.
  
• 3. Move this file into your LXPLUS or local institute's home space. For the purposes of these instructions we assume it is called MyKeys.p12.
  
• 4. All LXPLUS machines can "talk to the Grid" (in other words are user interfaces). This is set up by typing:
  

  $ source /afs/cern.ch/project/gd/LCG-share/current/etc/profile.d/grid_env.sh

  
  

  You need to do this every time you start work. If you are working on a machine in your institute or on a laptop, it must be set up as a User Interface. Please speak to your system administrator for assistance in this respect.

  
  
• 5. Type the following:

  $ openssl pkcs12 -in MyKeys.p12 -clcerts -nokeys -out usercert.pem

  $ openssl pkcs12 -in MyKeys.p12 -nocerts -out userkey.pem

  $ chmod 400 userkey.pem

  $ chmod 444 usercert.pem

  $ mv *.pem .globus/

  
  

  entering your password when requested. If you do not have a .globus/ directory in your home space, make one before issuing the last command above

• 6. To check everything is OK, type:

  $ voms-proxy-init

and you should be asked for your password, and a proxy certificate, which is valid for 12 hours, created. You must always have a valid proxy in place for your jobs to run. If it expires, so do the jobs. To make a longer certificate, you can do:

$ voms-proxy-init --valid hh:mm

Go to this page and click on the link marked "LCG Registration Form". Fill in the electronic details. Your Virtual Organisation is called "atlas". For this process to work, you must be registered at CERN as an ATLAS user - your application will be rejected otherwise. If your registration is accepted, your memebership of the ATLAS VO will be activated and a confirmatory e-mail sent to you.