As Simon points out to me, for a true standalone install you can run
dirac-admin-get-CAs
after you run "source bashrc".
If you do that e.g. once a day (or whenever you want to do something with dirac) that should also fix the problem.

Regards,
Daniela

On 22 September 2015 at 10:58, Daniela Bauer <daniela.bauer.grid@googlemail.com> wrote:
Hi Frederic,

indeed they do, hence they should be installed separately. I try to allude to this in my instructions, but clearly not well enough. I'm tempted to list this as a prerequisite (i.e. install certificates and crl cron job first, before installing the dirac UI), I was just worried it might get to confusing.
If the certificate directory you are now linking to is part of a standard UI, a mechanism (yum for the certificates + cron job for the crls) to update it should already be in place, so you shouldn't have to update it again.

Regards,
Daniela

On 22 September 2015 at 10:53, Frederic Brochu <brochu@hep.phy.cam.ac.uk> wrote:
        Hi Daniela,

Yes, doing it solved all my problems.
Here is the output of dirac-proxy-init:
-sh-4.1$ dirac-proxy-init -g gridpp_user -M
Generating proxy...
Enter Certificate password:
 Added VOMS attribute /gridpp
Uploading proxy for gridpp_user...
Proxy generated:
 subject      : /C=UK/O=eScience/OU=Cambridge/L=UCS/CN=frederic brochu/CN=proxy/CN=proxy
issuer       : /C=UK/O=eScience/OU=Cambridge/L=UCS/CN=frederic brochu/CN=proxy
identity     : /C=UK/O=eScience/OU=Cambridge/L=UCS/CN=frederic brochu
timeleft     : 23:53:59
DIRAC group  : gridpp_user
path         : /tmp/x509up_u1008
username     : frederic.brochu
properties   : NormalUser
 VOMS         : True
VOMS fqan    : ['/gridpp']

Proxies uploaded:
 DN                                                     | Group       | Until (GMT)
 /C=UK/O=eScience/OU=Cambridge/L=UCS/CN=frederic brochu | gridpp_user | 2016/07/28 15:12

 and the output of dirac-dms-add-file
dirac-dms-add-file /gridpp/user/f/f.brochu/TomoTherapy/phaseSpace360/XRay_phaseSpace360_7 XRay_phaseSpace360_7 UKI-NORTHGRID-LIV-HEP-disk

Uploading /gridpp/user/f/f.brochu/TomoTherapy/phaseSpace360/XRay_phaseSpace360_7
 Successfully uploaded file to UKI-NORTHGRID-LIV-HEP-disk


        Thank you very much,

                        Frederic

P.S: This is however opening another can of worms, as I expect these certificates will require updates that are more frequent than dirac client updates.



On Tue, 22 Sep 2015, Daniela Bauer wrote:

Hi Frederic,

I think this might be related to the fact that the dirac ui has no way to
automatically update the certs, crls etc.
In your dirac UI, can you link etc/grid-security/certificates to whereever
your standard grid UI is  getting these files from (possibly
/etc/grid-security/certificates or whatever X509_CERT_DIR is set to) and let
me know if that helps.

Cheers,
Daniela



On 22 September 2015 at 09:52, Frederic Brochu <brochu@hep.phy.cam.ac.uk>
wrote:
              Dear all,

      I am no longer able to copy and register files with
      dirac-dms-add-file.

      This command line used to work:
      dirac-dms-add-file
      /gridpp/user/f/f.brochu/TomoTherapy/phaseSpace360/XRay_phaseSpace360_5
      XRay_phaseSpace360_5 UKI-NORTHGRID-LIV-HEP-disk

      But when I am doing it now with a different file, I am getting:

      h-4.1$ dirac-dms-add-file
      /gridpp/user/f/f.brochu/TomoTherapy/phaseSpace360/XRay_phaseSpace360_7
      XRay_phaseSpace360_7 UKI-NORTHGRID-LIV-HEP-disk

      Uploading
      /gridpp/user/f/f.brochu/TomoTherapy/phaseSpace360/XRay_phaseSpace360_7
      createDirectory: Failed to create directory on storage.
srm://hepgrid11.ph.liv.ac.uk:8446/srm/managerv2?SFN=/dpm/ph.liv.ac.uk/home/
      gridpp/gridpp/user/f/f.brochu/TomoTherapy/phaseSpace360:
      SRM2Storage.__gfal_exec(gfal_ls): Execution failed. [SE][Ls][]
      httpg://hepgrid11.ph.liv.ac.uk:8446/srm/managerv2: CGSI-gSOAP
      running on pcjp reports Error initializing context
      GSS Major Status: Authentication Failed

      GSS Minor Status Error Chain:
      globus_gsi_gssapi: SSLv3 handshake problems
      globus_gsi_callb
      Error: failed to upload
      /gridpp/user/f/f.brochu/TomoTherapy/phaseSpace360/XRay_phaseSpace360_7
      to UKI-NORTHGRID-LIV-HEP-disk

      This is also true for any other site.

      Further to this, dirac-proxy-init also complains:

      dirac-proxy-init -g gridpp_user -M
      Generating proxy...
      Enter Certificate password:
      Could not add VOMS extensions to the proxy
      Failed adding VOMS attribute: Failed to set VOMS attributes.
      Command: voms-proxy-init -cert "/tmp/x509up_u1008" -key
      "/tmp/x509up_u1008" -out "/tmp/brochu/tmpuSlB4v" -voms
      "gridpp:/gridpp" -valid "23:54" -vomses
      "/var/clus/usera/brochu/gridpp/dirac_ui/etc/grid-security/vomses";
      StdOut: Your identity:
      /C=UK/O=eScience/OU=Cambridge/L=UCS/CN=frederic brochu/CN=proxy
      Creating temporary proxy  Done
      Contacting  voms.gridpp.ac.uk:15000
      [/C=UK/O=eScience/OU=Manchester/L=HEP/CN=voms.gridpp.ac.uk]
      "gridpp" Failed

      Trying next server for gridpp.
      Creating temporary proxy  Done
      Contacting  voms03.gridpp.ac.uk:15000
      [/C=UK/O=eScience/OU=Imperial/L=Physics/CN=voms03.gridpp.ac.uk]
      "gridpp" Failed

      Trying next server for gridpp.
      Creating temporary proxy  Done
      Contacting  voms02.gridpp.ac.uk:15000
      [/C=UK/O=eScience/OU=Oxford/L=OeSC/CN=voms02.gridpp.ac.uk]
      "gridpp" Failed
      ; StdErr: .....................................................
      Error: Error during SSL
      handshake:error:80066405:lib(128):verify_callback:outdated CRL
      found, revoking all certs till you get new CRL:sslutils.c:2115
      outdated CRL found, revoking all certs till you get new CRL
      Function: verify_callback
      error:80066411:lib(128):verify_callback:certificate failed
      verify::sslutils.c:2318
              error =CRL has expired
             
      subject=/C=UK/O=eScience/OU=Manchester/L=HEP/CN=voms.gridpp.ac.uk
              issuer =/C=UK/O=eScienceCA/OU=Authority/CN=UK e-Science
      CA 2B
      certificate failed verify:
              error =CRL has expired
             
      subject=/C=UK/O=eScience/OU=Manchester/L=HEP/CN=voms.gridpp.ac.uk
              issuer =/C=UK/O=eScienceCA/OU=Authority/CN=UK e-Science
      CA 2B
      Function: verify_callback
      error:14090086:SSL
      routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify
      failed:s3_clnt.c:1172
      certificate verify failed
      Function: SSL3_GET_SERVER_CERTIFICATE

      .....................................................
      Error: Error during SSL
      handshake:error:80066405:lib(128):verify_callback:outdated CRL
      found, revoking all certs till you get new CRL:sslutils.c:2115
      outdated CRL found, revoking all certs till you get new CRL
      Function: verify_callback
      error:80066411:lib(128):verify_callback:certificate failed
      verify::sslutils.c:2318
              error =CRL has expired
             
      subject=/C=UK/O=eScience/OU=Oxford/L=OeSC/CN=voms02.gridpp.ac.uk
              issuer =/C=UK/O=eScienceCA/OU=Authority/CN=UK e-Science
      CA 2B
      certificate failed verify:
              error =CRL has expired
             
      subject=/C=UK/O=eScience/OU=Oxford/L=OeSC/CN=voms02.gridpp.ac.uk
              issuer =/C=UK/O=eScienceCA/OU=Authority/CN=UK e-Science
      CA 2B
      Function: verify_callback
      error:14090086:SSL
      routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify
      failed:s3_clnt.c:1172
      certificate verify failed
      Function: SSL3_GET_SERVER_CERTIFICATE

      None of the contacted servers for gridpp were capable
      of returning a valid AC for the user.


       Are you sure you are properly registered in the VO?
      Uploading proxy for gridpp_user...
      Proxy generated:
      subject      : /C=UK/O=eScience/OU=Cambridge/L=UCS/CN=frederic
      brochu/CN=proxy
      issuer       : /C=UK/O=eScience/OU=Cambridge/L=UCS/CN=frederic
      brochu
      identity     : /C=UK/O=eScience/OU=Cambridge/L=UCS/CN=frederic
      brochu
      timeleft     : 23:59:58
      DIRAC group  : gridpp_user
      path         : /tmp/x509up_u1008
      username     : frederic.brochu
      properties   : NormalUser
      Proxies uploaded:
       DN                                                     | Group 
           | Until (GMT)
       /C=UK/O=eScience/OU=Cambridge/L=UCS/CN=frederic brochu |
      gridpp_user | 2016/07/28 15:12


      On the other hand, voms-proxy-init works a charm:
      -sh-4.1$ voms-proxy-init -voms gridpp
      Enter GRID pass phrase for this identity:
      Contacting voms03.gridpp.ac.uk:15000
      [/C=UK/O=eScience/OU=Imperial/L=Physics/CN=voms03.gridpp.ac.uk]
      "gridpp"...
      Remote VOMS server contacted succesfully.


      Created proxy in /tmp/x509up_u1008.

      Your proxy is valid until Tue Sep 22 21:48:30 BST 2015


      All this is only affecting my ability to upload and register
      data to storage elements. Job submission and output collection
      are still working fine.

      Any idea? I am using the dirac version mentioned in the subject.

                      Best regards,

                                      Frederic


      --
      _______________________________________________
      Gridpp-Dirac-Users mailing list
      Gridpp-Dirac-Users@imperial.ac.uk
      https://mailman.ic.ac.uk/mailman/listinfo/gridpp-dirac-users




--
Sent from the pit of despair

-----------------------------------------------------------
daniela.bauer@imperial.ac.uk
HEP Group/Physics Dep
Imperial College
London, SW7 2BW
Tel: +44-(0)20-75947810
http://www.hep.ph.ic.ac.uk/~dbauer/




--
Sent from the pit of despair

-----------------------------------------------------------
daniela.bauer@imperial.ac.uk
HEP Group/Physics Dep
Imperial College
London, SW7 2BW
Tel: +44-(0)20-75947810
http://www.hep.ph.ic.ac.uk/~dbauer/



--
Sent from the pit of despair

-----------------------------------------------------------
daniela.bauer@imperial.ac.uk
HEP Group/Physics Dep
Imperial College
London, SW7 2BW
Tel: +44-(0)20-75947810
http://www.hep.ph.ic.ac.uk/~dbauer/