    NAME
         util/sgeCA/sge_ca - Sun Grid Engine CSP Support control com-
         mand

    SYNTAX
         sge_ca command [command options]

    DESCRIPTION
         sge_ca controls a simple Sun Grid Engine Certificate Author-
         ity that is used for the special Certificate Security Proto-
         col (CSP) mode.  CSP mode improves the security behavior  of
         Sun  Grid  Engine  by enabling OpenSSL secured communication
         channels and  X509v3  certificates  for  authentication.  In
         addition  it  is  possible  to export the key material or to
         create JKS keystores for the JMX connector.   It  follows  a
         list  of  possible  commands  and command options to give an
         overview  which  functionality  is  available.  For  further
         details  about  every  command  refer to the COMMAND DETAILS
         section.

    COMMAND OVERVIEW
         sge_ca [-help]
              show usage

         sge_ca -init [command options]
              create the infrastructure for a  new  Sun  Grid  Engine
              Certificate  Authority with its corresponding files and
              directories and a set of keys and certificates for  SGE
              Daemon, root and admin user.

         sge_ca -req | -verify <cert> | -sign | -
              copy [command options]
              manipulate individual keys and certificates

         sge_ca -print <cert> | -printkey <key> | -printcrl <crl>
              print out certificates, keys and certificate revocation
              lists in human readable form.

         sge_ca -showCaTop | -showCaLocalTop [command options]
              echo the $CATOP or $CALOCALTOP directory. This  command
              is  usually  run as root on the qmaster host after a CA
              infrastructure has been  created.  If  "-cadir"  or  "-
              catop"  or  "-calocaltop"  are  set  the  corresponding
              directories are printed.

    <u:g:e> [command options]
         sge_ca -usercert  <user  file>  |  -user  <u:g:e>  |  -
              sdm_daemon
              are used for creation of certificates and  keys  for  a
              bunch  of users contained in <user file>, a single user
              or SDM daemon <u:g:e>. (see hedeby_introduction(1) )

    options]
         sge_ca -pkcs12 <user> | -sdm_pkcs12 <g>  |  -
              sys_pkcs12  [command
              are used to export the certificate  and  key  for  user
              <user> or SDM daemon <g> in pkcs12 format and to export
              the SGE Daemon certificate and key in pkcs12 format.

         sge_ca -userks | -ks <user> | -sysks [command options]
              are used for creation of keystore for all users with  a
              certificate  and  key,  the  keystore for a single user
              <user> and the keystore containing the SGE Daemon  cer-
              tificate and key.

    [command options]
         sge_ca -renew <user> | -renew_ca | -renew_sys  |  -
              renew_sdm  <g>
              are used to renew the  corresponding  certificates  for
              user <user>, for the CA, for the SGE Daemon certificate
              and for the SDM daemon <g> certificate.

         where "[command options]" is a combination of the  following
         options  depending  on the command. The COMMAND DETAILS sec-
         tion explains which options are usable for each command.

         -days <days>
              days of validity of the certificate

         -sha1
              use sha-1 instead of md5 as message digest

         -encryptkey
              use des to encrypt the generated  private  key  with  a
              passphrase.  The  passphrase is requested when a key is
              created or used.

         -outdir <dir>
              write to directory <dir>

         -cahost <host>
              define CA hostname (CA master host)

         -cadir <dir>
              define $CALOCALTOP and $CATOP settings

         -calocaltop <dir>
              define $CALOCALTOP setting

         -catop <dir>
              define $CATOP setting

         -kspwf <file>
              define  a  keystore  password  file  that  contains   a
              password  that  is used to encrypt the keystore and the
              keys contained therein

         -ksout <file>
              define output file to write the keystore to

         -pkcs12pwf <file>
              define a pkcs12 password file that contains a  password
              that  is used to encrypt the pkcs12 export file and the
              keys contained therein

         -pkcs12dir <dir>
              define the output directory <dir> to write the exported
              pkcs12  format  file  to. Otherwise the current working
              directory is used.

    COMMAND DETAILS
    [-adminuser <admin>] [-days <num days>]
         sge_ca -init [-cadir <dir>] [-catop  <dir>]  [-
              calocaltop  <dir>]
              The -init command creates a new Sun Grid Engine  certi-
              ficate  authority  and its corresponding files. Usually
              "sge_ca -init" is run by user root on the master  host.
              If  the options -adminuser, -cadir, -calocaltop, -catop
              and the Sun Grid Engine environment variables SGE_ROOT,
              SGE_CELL  and  SGE_QMASTER_PORT  are  set the CA direc-
              tories are created in the following locations:
              two letter country code, state, location, e.g  city  or
              your  buildingcode,  organization  (e.g.  your  company
              name), organizational unit, e.g. your department, email
              address of the CA administrator (you!)

              Certificates and keys are generated for the CA  itself,
              for SGE Daemon, for SGE install user (usually root) and
              finally for the SGE admin user.

              How and where the certificates and keys are created can
              be influenced additionally by:
              -days <days> change the time of validity of the  certi-
              ficates to number of <days> instead of 365 days
              -sha1 change the message digest algorithm from  md5  to
              sha-1
              -encryptkey  encrypt  the   generated   keys   with   a
              passphrase
              -adminuser <user> use <user> as admin user
              -cahost <host> use <host> as the CA master host
              [-cadir <dir>] [-catop <dir>  [-calocaltop  <dir>]  set
              $CATOP  and  $CALOCALTOP to <dir> to use something dif-
              ferent than the Sun Grid  Engine  default  directories.
              Either  -cadir  <dir>  has  to  be specified to replace
              $CATOP and $CALOCALTOP by the same directory or  -catop
              <dir> for $CATOP and -calocaltop <dir> for $CALOCALTOP.

    <dir>] [-adminuser <admin>] [-days <days>]
         sge_ca -user <u:g:e> [-cadir <dir>] [-catop  <dir>]  [-
              calocaltop
              generate certificate and keys for <u:g:e> with  u='Unix
              user   account  name',  g='common  name'  and  e='email
              address'. By default the certificate is valid  for  365
              days  or  by  <days> specified with -days <days>.  This
              command is usually run as  user  root  on  the  qmaster
              host. $CATOP and $CALOCALTOP maybe overruled by -cadir,
              -catop and -calocaltop.

         sge_ca -sdm_daemon <u:g:e>
              generate daemon certificate and keys for  <u:g:e>  with
              u='Unix   user   account  name',  g='common  name'  and
              e='email address'. By default the certificate is  valid
              for  365  days  or  by  <days>  specified  with  "-days
              <days>". This command is usually run as  user  root  on
              the qmaster host.

    calocaltop   <dir>]   [-adminuser   <admin>]  [-days  <days>]  [-
    encryptkey] [-sha1]
         sge_ca -usercert <user file> [-cadir  <dir>]  [-
              catop  <dir>]  [-
              Usually sge_ca -usercert <user file>  is  run  as  user
              root  on the master host. The argument <user file> con-
              tains a list of users in the following format:

                  eddy:Eddy Smith:eddy@griders.org
                  sarah:Sarah Miller:sarah@griders.org
                  leo:Leo Lion:leo@griders.org

              where the fields separated by colon are:
                  Unix user:Gecos field:email address

    <dir>] [-adminuser <admin>] [-days <days>]
         sge_ca -renew <user> [-cadir <dir>] [-catop  <dir>]  [-
              calocaltop
              Renew the certificate for <user>. By default the certi-
              ficate  is extended for 365 days or by <days> specified
              with -days <days>. If the value is negative the  certi-
              ficate becomes invalid.  This command is usually run as
              user root on the qmaster host. $CATOP  and  $CALOCALTOP
              maybe overruled by -cadir, -catop and -calocaltop.

    <dir>] [-adminuser <admin>] [-days <days>]
         sge_ca  -renew_ca  [-cadir  <dir>]  [-catop  <dir>]  [-
              calocaltop
              Renew the CA certificate. By default the certificate is
              extended for 365 days or by <days> specified with -days
              <days>.  If  the  value  is  negative  the  certificate
              becomes  invalid.   This command is usually run as user
              root on the qmaster host. $CATOP and $CALOCALTOP  maybe
              overruled by -cadir, -catop and -calocaltop.

    <dir>] [-adminuser <admin>] [-days <days>]
         sge_ca -renew_sys  [-cadir  <dir>]  [-catop  <dir>]  [-
              calocaltop
              Renew the SGE Daemon certificate. By default the certi-
              ficate  is extended for 365 days or by <days> specified
              with -days <days>. If the value is negative the  certi-
              ficate becomes invalid.  This command is usually run as
              user root on the qmaster host. $CATOP  and  $CALOCALTOP
              maybe overruled by -cadir, -catop and -calocaltop.

    <dir>] [-adminuser <admin>] [-days <days>]
         sge_ca -renew_sdm <g> [-cadir <dir>] [-catop <dir>]  [-
              calocaltop
              Renew the SDM daemon certificate of <g>, where  <g>  is
              the  common name of the daemon. By default the certifi-
              cate is extended for 365 days or  by  <days>  specified
              with  -days <days>. If the value is negative the certi-
              ficate becomes invalid.  This command is usually run as
              user  root  on the qmaster host. $CATOP and $CALOCALTOP
              maybe overruled by -cadir, -catop and -calocaltop.

    cadir  <dir>]  [-catop  <dir>]  [-calocaltop  <dir>]  [-adminuser
    <admin>]
         sge_ca -pkcs12 <user> [-pkcs12pwf <file>] [-
              pkcs12dir  <dir>]  [-
              export certificate and key of  user  <user>  'the  Unix
              user  name'  in  pkcs12 format. This command is usually
              run as user root on the  qmaster  host.  If  -pkcs12pwf
              <file>  is used the file and the corresponding key will
              be encrypted with the password in <file>. If -pkcs12dir
              <dir>   is   used  the  output  file  is  written  into
              <dir>/<user>.p12 instead of ./<user>.p12 .  $CATOP  and
              $CALOCALTOP  maybe  overruled  by  -cadir,  -catop  and
              -calocaltop.

    <dir>] [-catop <dir>] [-calocaltop <dir>] [-adminuser <admin>]
         sge_ca -sys_pkcs12 [-pkcs12pwf <file>] [-
              pkcs12dir <dir>] [-cadir
              export certificate and key of SGE Daemon in pkcs12 for-
              mat.  This  command  is usually run as user root on the
              qmaster host. If -pkcs12pwf <file> is used the file and
              the  corresponding key will be encrypted with the pass-
              word in <file>. If -pkcs12dir <dir> is used the  output
              file   is  written  into  <dir>/<user>.p12  instead  of
              ./<user>.p12 . $CATOP and $CALOCALTOP  maybe  overruled
              by -cadir, -catop and -calocaltop.

    cadir  <dir>]  [-catop  <dir>]  [-calocaltop  <dir>]  [-adminuser
    <admin>]
         sge_ca -sdm_pkcs12 <g> [-pkcs12pwf <file>] [-
              pkcs12dir <dir>]  [-
              export certificate and  key  of  daemon  <g>  g='common
              name'  in pkcs12 format. This command is usually run as
              user root on the qmaster host. If -pkcs12pwf <file>  is
              used  the  file  and  the  corresponding  key  will  be
              encrypted with the password in  <file>.  If  -pkcs12dir
              <dir>   is   used  the  output  file  is  written  into
              <dir>/<g>.p12 instead of ./<g>.p12 . $CATOP and  $CALO-
              CALTOP  maybe overruled by -cadir, -catop and -calocal-
              top.

    [-catop <dir>] [-calocaltop <dir>] [-adminuser <admin>]
         sge_ca -ks <user> [-ksout <file>] [-kspwf <file>] [-
              cadir  <dir>]
              create a keystore containing  certificate  and  key  of
              user <user> in JKS format where <user> is the Unix user
              name. This command is usually run as user root  on  the
              qmaster host. If -kspwf <file> is used the keystore and
              the corresponding key will be encrypted with the  pass-
              word  in <file>. The -ksout <file> option specifies the
              keystore file that is created.  If  the  -ksout  <file>
              option is missing the default location for the keystore
              is $CALOCALTOP/userkeys/<user>/keystore.  This  command
              is usually invoked by sge_ca -userks. A prerequisite is
              a valid JAVA_HOME environment variable setting.  $CATOP
              and  $CALOCALTOP  maybe overruled by -cadir, -catop and
              -calocaltop.

    calocaltop <dir>] [-adminuser <admin>]
         sge_ca -userks [-kspwf <file>] [-cadir <dir>] [-
              catop  <dir>]  [-
              generate a keystore in JKS format for all users  having
              a  key and certificate.  This command is usually run as
              user root on the qmaster host.   If  -kspwf  <file>  is
              used  the  keystore  and  the corresponding key will be
              encrypted with the password in  <file>.   The  keystore
              files             are             created            in
              $CALOCALTOP/userkeys/<user>/keystore. This  command  is
              run  after user certificates and keys have been created
              with sge_ca -usercert <userfile> or if any of the  cer-
              tificates  have  been  renewed.  $CATOP and $CALOCALTOP
              maybe overruled by -cadir, -catop and -calocaltop.

    calocaltop <dir>] [-adminuser <admin>]
         sge_ca -sysks [-kspwf <file>] [-cadir <dir>]  [-
              catop  <dir>]  [-
              generate a keystore containing the SGE Daemon  certifi-
              cate  and  key  in JKS format.  This command is usually
              run as user root on the qmaster host.  If -kspwf <file>
              is  used the keystore and the corresponding key will be
              encrypted with the password in  <file>.   The  keystore
              file is created in $CALOCALTOP/private/keystore. $CATOP
              and $CALOCALTOP maybe overruled by -cadir,  -catop  and
              -calocaltop.

         sge_ca -print <cert>
              Print a certificate where <cert> is  the  corresponding
              certificate in pem format.

         sge_ca -printkey <key>
              Print a key where <key> is the corresponding key in pem
              format.

         sge_ca -printcrl <crl>
              Print a certificate revocation list where <crl> is  the
              corresponding  certificate  revocation list in pem for-
              mat.

         sge_ca -printcrl <crl>
              Print a certificate revocation list where <crl> is  the
              corresponding  certificate  revocation list in pem for-
              mat.

    adminuser  <admin>] [-days <days>] [-encryptkey] [-sha1] [-outdir
    <dir>]
         sge_ca -req [-cadir <dir>] [-catop <dir>] [-
              calocaltop <dir>]  [-
              create a private key and a certificate request for  the
              calling  user.  This  are  created  as  newkey.pem  and
              newreq.pem in the current working  directory.   If  the
              option -outdir <dir> is specified in addition the files
              are created in <dir>.

    [-adminuser  <admin>]  [-days  <days>]  [-encryptkey]  [-sha1] [-
    outdir <dir>
         sge_ca -sign [-cadir <dir>] [-catop  <dir>]  [-
              calocaltop  <dir>]
              Sign a certificate request. The  CA  certificate  under
              $CATOP  (default: $SGE_ROOT/$SGE_CELL/common/sgeCA) and
              CA      key      from       $CALOCALTOP       (default:
              /var/sgaCA/{port$SGE_QMASTER_PORT|sge_qmaster}/$SGE_CELL)
              are used for the signature.  If $CATOP and  $CALOCALTOP
              are  set to a different directory the information there
              is used. The certificate is created as  newcert.pem  in
              the current working directory or in <dir> if the option
              -outdir <dir>  has  been  specified.  In  addition  the
              option  "-days  <number  of  days>" can be specified to
              change the default validity from 365 to number of days.

    <dir>] [-adminuser <admin>]
         sge_ca -verify <cert> [-cadir <dir>] [-catop <dir>]  [-
              calocaltop
              Verify a certificates  validity  where  <cert>  is  the
              corresponding  certificate  in  pem  format. $CATOP and
              $CALOCALTOP can be  overruled  by  -cadir,  -catop  and
              -calocaltop.

         sge_ca -copy [-cadir <dir>] [-catop <dir>] [-
              calocaltop <dir>]
              sge_ca -copy is run by a user to copy the users  certi-
              ficate    and    key    on    the    master   host   to
              $HOME/.sge/port$SGE_QMASTER_PORT/$SGE_CELL/certs/cert.pem
              and     the     corresponding     private     key    in
              $HOME/.sge/port$SGE_QMASTER_PORT/$SGE_CELL/private/key.pem
              which  are  used  instead  of  the  files in $CATOP and
              $CALOCALTOP. The command is only recommended for  test-
              ing  purposes or where $HOME is on a secure shared file
              system.

    EXAMPLES
         # sge_ca -init -cadir /tmp -sha1 -encryptkey -days 31
              create a CA infrastructure in /tmp with  a  certificate
              validity  of 31 days using sha-1 instead of md5 as mes-
              sage digest.The keys are encrypted and a passphrase has
              to be entered during the creation of the different keys
              or during signing a certificate  with  the  created  CA
              key.

         # sge_ca -usercert /tmp/myusers.txt -cadir /tmp
              /tmp/myusers.txt contains user1:My User:user1@myorg.org
              and  user1  is  a valid Unix user account. Create a key
              and certificate for user1.

         # sge_ca -userks -cadir /tmp
              create a keystore for all users of the simple  CA.  The
              keystore is stored under /tmp/userkeys/<user>/keystore.

         # sge_ca -renew root -cadir /tmp -days -1
              make the root certificate temporarily invalid.

         # sge_ca -renew_ca -days 365 -cadir /tmp
              renew the CA certificate for 365 days

    ENVIRONMENTAL VARIABLES
         SGE_ROOT       Specifies the location of the Sun Grid Engine
                        standard configuration files.

         SGE_CELL       If set, specifies the default Sun Grid Engine
                        cell.

    RESTRICTIONS
         <I>sge_ca The command must be  usually  called  with  Sun  Grid
         Engine  root  permissions  on  the  master  host.   For more
         details on the permission requirements consult the  detailed
         description for the different commands above.

    FILES
         sge_ca creates a file tree starting in $CATOP and  $CALOCAL-
         TOP.     The     default     for     $CATOP    is    usually
         $SGE_ROOT/$SGE_CELL/common/sgeCA   and    for    $CALOCALTOP
         /var/sgeCA/{port$SGE_QMASTER_PORT|sge_qmaster}/$SGE_CELL
         where the subpaths beginning with $ expands to  the  content
         of the corresponding environment variable.

         In addition there may optionally exist the user  certificate
         in $HOME/.sge/port$SGE_QMASTER_PORT/$SGE_CELL/certs/cert.pem
         and     the      corresponding      private      key      in
         $HOME/.sge/port$SGE_QMASTER_PORT/$SGE_CELL/private/key.pem
         which are used instead of the files in $CATOP and  $CALOCAL-
         TOP. (see sge_ca -copy above)

    SEE ALSO
         sge_qmaster(8).

    COPYRIGHT
         See sge_intro(1) for a full statement of rights and  permis-
         sions.