the EUChinaGRID Procedure for new users

In order to access the EUChinaGrid infrastructure you must have a personal certificate, issued from one of the Certification Authorities (CAs) trusted by the project. The list of these Certification Authorities can be inspected here.

Once you get the certificate, you need to become a member of the euchina Virtual Organisation (VO) registering yourself in the relative web page of the Virtual Organization Membership Service (VOMS).

Step 1: You must read and agree with the Acceptable Use Policy.

Step 2: With your personal certificate installed in your browser, you can perform the euchina VO registration request here.

Step 3: Once the user is a member of euchina VO and has got his VOMS credentials, in order to use the EUChinaGrid infrastructure he has now to access an User Interface machine. For this, the easiest way at the moment is

• Request an account on the official User Interface mailing the EUChinaGrid Operations Centre (please contact Enrico Fattibene)
• Download and install the free VMware Player from the URL
• http://www.vmware.com/download/player/
• Download the User Interface Virtual Machine from the URL
• https://gilda.ct.infn.it/UIVMcomb/GILDAVM_Comb.tar.bz2
• To see how to start it up, have a look at the "readme" located at the URL
• https://gilda.ct.infn.it/UIVMcomb/GILDAVM_Comb_readme.txt

Step 4: Once the User Interface is installed, users need to export their certificate from their web browser to the User Interface and convert it in a format suitable for the use on the grid. If your certificate is in the PKCS12 format, you can change its format in PEM using the pkcs12 command installed in the openssl packet.

When you submit a job in grid, the certificate must be in your user interface. So, it is necessary:

• to copy your certificate in your UI;
• to digit the following commands to change the .p12 certificate extension:
  - $ openssl pkcs12 -nocerts -in my_cert.p12 -out userkey.pem
  (it create a private key through the option -nocerts)
  - $ openssl pkcs12 -clcerts -nokeys -in my_cert.p12 -out usercert.pem
  (it create the certificate through the option -nokeys)
  NB: the -clcerts option determines that only the client certificate must be create.
• Modify the files permit through the command:
  $chmod 400 userkey.pem
  $chmod 644 usercert.pem

It is possible to follow the detailed procedure in this video tutorial.