Where to put the CA (Certification Authority) certificates?
All network connections between the UNICORE components use client-authenticated SSL (Secure Sockets Layer), i.e. both sides of the connection check that they trust the other side. “Trust” means that the CA is checked. If you use a single CA for all your certificates, the configuration is rather simple: Each server component needs to know the CA certificate, and additionally the CA has to be loaded in the client’s keystore. If you use multiple CA’s, consider how the UNICORE components work together: The client communicates with the Gateway, so the Gateway has to know the user’s CA and the client has to know the CA of the Gateway. The Gateway also communicates with the Registry and UNICORE/X, so the Registry and UNICORE/X should know the Gateway’s CA and vice versa. Additionally, the UNICORE/X communicates with the XUUDB, so both components need to know each other’s CA certificates.
