Monday, October 8, 2007

Across Grids: got CA certificates?

I had problem GridFTP between gf1 and BigRed earlier. On gf1.ucs.indiana.edu:

$globus-url-copy -vb gsiftp://gridftp.bigred.iu.teragrid.org/N/dc/scratch/myusername/8GB gsiftp://gf1.ucs.indiana.edu/home/myusername/8GB

error: globus_ftp_control: gss_init_sec_context failed
OpenSSL Error: s3_clnt.c:842: in library: SSL routines, function SSL3_GET_SERVER_CERTIFICATE: certificate verify failed
globus_gsi_callback_module: Could not verify credential
globus_gsi_callback_module: Could not verify credential: self signed certificate in certificate chain


It turns out that I was missing gf1 server certificates in ~/.globus/certificates/. Copied from /etc/grid-security/certificates/, all happy then.

3 comments:

Unknown said...

Note also the TeraGrid did not have to trust the host certificate of gf1 and vice versa. The authentication between the servers used your delegated user credential.

Unknown said...

I have the same problem... copying certs into ~/.globus/certificates did not help me. Any other ideas?

Anonymous said...

Keep up the good work.