CERN Accelerating science

Catch-all Certification Authorities for WLCG

For many years, the WLCG Catch-all CA used to provide certificates for users and services not otherwise covered by one of the approved WLCG Certification Authorities (CA). The service actually was run as a "Registration Authority" (RA) of the OSG PKI. In the spring of 2018 it got decommissioned as part of a reorganisation of the OSG operations services. We thank OSG for having supported the catch-all CA service for many years!

Here we describe options for obtaining certificates in case ALL of the following are true:

  • you are eligible to be part of a recognized WLCG Virtual Organisation (VO) or work in a related project
  • you could not reasonably be expected to obtain a certificate from another approved WLCG CA
  • you require the certificate for an activity related to WLCG or an affiliated project

Procedure

If you do not have a national Certification Authority, and you are not eligible for a certificate from the CERN Grid CA, contact project-lcg-certificates at cern dot ch.

The project-lcg-certificates experts will look into your situation and advise on further action.

As of August 2018, there are at least the following potential routes to get user and/or grid service certificates in such cases:

  • If you are part of an organisation affiliated with EGI and related projects (e.g. an LHC experiment), the SEE-GRID catch-all CA service may be able to help you. Mind that it requires a suitable representative for your organisation or country to set up a Registration Authority dealing with the certificate requests.
  • If your NREN (National Research and Education Network) is connected to GEANT, it could subscribe to the TCS service, which typically costs a few k Euro per year and then would provide the NREN with support for user and service certificates needed by the organisations it represents, e.g. universities connected to the NREN infrastructure.
  • For user certificates you may also consider the CILogon service used e.g. by OSG. Mind that an explicit arrangement with CILogon will typically be needed, as their free Basic CA is not included in the IGTF distribution, hence not suitable for use in grid workflows. IGTF currently includes the CILogon OSG and Silver CAs. The CILogon OSG CA served as the base of the former catch-all CA service and is decommissioned.

Further links

 

Page last updated on: 11 Aug 2018