Globus CA expired
Incident Report for CU Boulder RC
Resolved
We reached out the Globus Shared Endpoint admins individually in order to have all shared endpoints recreated and fixed. So we are closing this issue.
If for some reason, you are still unable to authenticate to an endpoint, please contact us at rc-help@colorado.edu.
Posted Aug 24, 2018 - 16:42 MDT
Update
Regarding the Globus Shared Endpoints, we are actively testing the procedure to have the endpoints operating again. We spent some time to identify a procedure that would be as simple as possible for the Shared Endpoint admins. That involves recreating the Shared Endpoints with the same permissions and rules defined today. We likely won't be able to recreate all the endpoints in a single day next week, mainly because it will require to work together with the admins. But we will try to complete this process as early as possible.
Posted Aug 10, 2018 - 21:01 MDT
Update
Please note that only transfers that use a shared endpoint in either the source or destination should fail.

Transfers that don't use a shared endpoint are expected to work as long as credentials are deactivated for the host endpoint used and you re authenticate in that endpoint. (To deactivate your credential for an endpoint, please go to Endpoints tab, click on the 3 dots for the endpoint you want to use and then press "Deactivate Credentials". Then please re authenticate again).

We will contact tomorrow the shared endpoint admins with instructions to fix those endpoints as well.

Sorry for the trouble,
Patricia
Posted Aug 09, 2018 - 19:01 MDT
Update
Login to Research Computing Globus endpoints works now.
We had a Certificate Authority cert that expired and the host certificate in place for the data transfer nodes was issued using that CA cert, so that the expired cert invalidated the host certificate. We replaced the host certificate and now this issue is solved.

However the shared endpoints certificates are now also invalid (just like the host certificate). So, transfers probably will fail.
We will send instructions tomorrow accordingly to fix that and provide assistance as needed.

- Patricia
Posted Aug 09, 2018 - 18:40 MDT
Investigating
Globus users,

If you try to login in Globus RC endpoints, you will get "The certificate has expired: Credential with subject: /C=US/O=Globus Consortium/CN=Globus Connect CA has expired.\n".

This is something that appeared today and is being investigated.

I'll report, once we have more news.

- Patricia
Posted Aug 09, 2018 - 09:48 MDT
This incident affected: Research Computing Core.