Certificate F.A.Q.

Warning, important It is recommended to do it with FIREFOX Warning, important

Get a certificate

There are two ways to get a certificate:
  1. Through CERN.
    • This should be easier. But for this your CERN account cannot be "external" (you need to be in the "USER" group, "PART" is not enough). This means that for new users they need to either show up at the User's Office to fully register, or they should opt for option 2.
    • Request a new certificate at https://ca.cern.ch/ca
  2. Through a Certification Authority (CA) of your home country. (you can find it at http://wlcg.web.cern.ch/getting-started/certificates )

Renew a certificate

Renewing really means requesting a new certificate.
  • You will have two valid certificates for a brief period. That's ok.
  • CERN certificates can be requested at https://ca.cern.ch/ca
  • You do not have to resign the Virtual Organisation (VO) terms and agreements (they can also expire, but independently from the certificate).

Export the certificate to your browser

Once you got your certificate you should export it. It can then be uploaded to other browser(s) and copied to lxplus for grid usage. Details and screenshots can be found in the Help Contents at https://ca.cern.ch/ca/Help/.

Convert the certificate for grid usage

Once you exported your certificate transfer the p12-file to your LXPLUS home directory. Now use the command below to have your certificate properly installed in your .globus directory.
cert-convert.sh MyFile.p12
Make sure that you pass phrase is not empty nor shorter than 6 characters

If you want to do this step manually, you should convert the certificate obtained above into one usable for the Grid, following instructions in https://gridca.cern.ch/gridca/Help/?kbid=023010. Slides 15 to 17 of the presentation show some screenshots of the procedure.

Join the LHCb Virtual Organisation

In order to be able to use your certificate for submitting jobs to the DIRAC system you need to join the LHCb Virtual Organisation (VO). To do this go to the web page https://lcg-voms2.cern.ch:8443/voms/lhcb, follow the instructions to join as explained here : https://cern.service-now.com/service-portal/article.do?n=KB0003002&s=lhcb%20vo . You then have to wait for this to be approved (confirmation sent by mail). Warning, important : If you get the message "you are already registered, please send a mail to project-lcg-vo-lhcb-admin- at -cern.ch and ask to be remove from the VO to continue the registration.

Sign the "Grid Acceptable Use Policy" (aka AUP)

This may be done via the VOMS portal at https://lcg-voms2.cern.ch:8443/voms/lhcb/aup/load.action even if already done.

Using the certificate

After obtaining a certificate for the first time, you should upload a proxy to DIRAC, using (on lxplus) the commands:
lb-run LHCbDirac/prod bash -norc
lhcb-proxy-init
or
lb-run LHCbDirac/prod lhcb-proxy-init

DIRAC will remind you periodically (currently once a year), by sending you a mail whose subject is "Your proxy uploaded to DIRAC will expire in xx days", when you need to upload a new proxy.

Your proxy is necessary for accessing the bookkeeping, and of course for submitting jobs on the Grid. Once you have installed your certificate (e.g. on lxplus), get a proxy (which has a limited validity) using the lhcb-proxy-init command.

More information with lhcb-proxy-init -h (e.g. for setting a non-default validity)

Be aware that it might take about 24 hours after your Virtual Organisation membership has been approved before this works.

Edit | Attach | Watch | Print version | History: r31 < r30 < r29 < r28 < r27 | Backlinks | Raw View | WYSIWYG | More topic actions
Topic revision: r31 - 2018-02-20 - ChristopherMarkBurr
 
    • Cern Search Icon Cern Search
    • TWiki Search Icon TWiki Search
    • Google Search Icon Google Search

    LHCb/FAQ All webs login

This site is powered by the TWiki collaboration platform Powered by PerlCopyright & 2008-2018 by the contributing authors. All material on this collaboration platform is the property of the contributing authors.
Ideas, requests, problems regarding TWiki? Send feedback