Dear JGlobus developers,
recently it was discovered that JGlobus refuses proxies that have the
non-repudiation flag set in the key usage. This issue is at least affecting
proxy certificates from the GridCanada CA and thereby users from the
ATLAS experiment at CERN.
The matter has been discussed in a GGUS ticket (not world-readable):
My guess is that a draft version of the RFC required these bits be cleared
from a proxy certificate.
If Andrea now cannot find a reference to that in the final RFC, it seems
this requirement was dropped during the review process, but that the
Globus code to generate the proxy continues to clear these bits,
if set in the parent certificate.
Andrea Ceccanti:
yes Globus clears those bits when creating a proxy,
and this is not harmful per se.
The problem in JGlobus, and only there AFAIU, is that the library
requires the bits to be clear when validating a proxy.
Maarten Litmaath:
it seems a quick fix would be to have this line commented out for now:
Dear JGlobus developers, recently it was discovered that JGlobus refuses proxies that have the non-repudiation flag set in the key usage. This issue is at least affecting proxy certificates from the GridCanada CA and thereby users from the ATLAS experiment at CERN.
The matter has been discussed in a GGUS ticket (not world-readable):
https://ggus.eu/index.php?mode=ticket_info&ticket_id=124650#update#30
The gist of that discussion follows here:
Andrea Ceccanti:
Paul Millar:
Andrea Ceccanti:
Maarten Litmaath:
Can you look into that? Thanks!