Globus Connect Server Endpoint Domain Update

Name

globus-connect-server endpoint domain update - Set the domain name and certificate on a Globus Connect Server endpoint (new in v5.4.13)

Synopsis

globus-connect-server endpoint domain update [OPTIONS]…

Description

The globus-connect-server endpoint domain update command updates the domain name, certificate, and private used by the endpoint.

In order to use this command, one of your Globus identities must have an administrator or owner role on the endpoint.

By default, Globus Connect Server uses a Globus-operated DNS service to provide DNS names to access collections and the Globus Connect Server management API. These names are randomly issued subdomains of the data.globus.org domain.

The globus-connect-server endpoint domain update command configures the domain and certificate used by a endpoint to be one that the administrator controls. The domain may be a wildcard or standard A or AAAA record. The certificate and key may be either managed or unmanaged by Globus.

Domain Names

When using this feature, Globus Connect Server allows any DNS domain name that the administrator controls to serve the Globus services for your endpoint. These names may be A, AAAA, or CNAME records, as is suitable for the endpoint’s configuration.

The --domain DOMAIN option to this command sets the domain name for the endpoint.

Wildcards

The domain name used by the endpoint can be set to either be a wildcard or non-wildcard domain. This setting affects what DNS name other related collections on the endpoint will have.

The default for the endpoint is to assume the domain not a wildcard. In this case, all collections created on the endpoint will use the subdomains of the data.globus.org domain created during endpoint setup.

The --wildcard flag to this command makes Globus Connect Server treat the domain name as a wildcard.

If the endpoint is configured with a wildcard domain, then all collections created on the endpoint will use subdomains of that wildcard domain unless they are themselves configured to use their own custom domain.

This means, for example, that if you configure your endpoint to use the wildcard domain globus-data.example.org, then a mapped collection may be automatically issued a name like m-766bd244.globus-data.example.org.

Certificates and Keys

Globus Connect Server requires certificates and keys to match the domain name (including wildcard domain property).

The --certificate-path CERTIFICATE and -private-key PRIVATE_KEY command-line parameters set the certificate and private key path. If additional certificates are needed by clients to validate the certificate, they can be set using the --certificate-chain-path CERTIFICATE_CHAIN command-line parameter. The contents of these files must be PEM-encoded.

Managed Certificates and Keys

Globus Connect Server can optionally manage synchronizing changes to the certificate and key files between data transfer nodes. This is enabled by passing the --managed command line option.

When this is enabled, the certificate chain and key are encrypted and synchronized between data transfer nodes along with other configuration data.

If this is not enabled, only the paths to the certificate and key files are synchronized. These files must exist on each data transfer node in order for the Globus services to function properly.

Options

-h, --help: Show help message and exit.
--version: Show the version and exit.
--use-explicit-host IP_ADDRESS (new in 5.4.23): IP address of the GCS node to use for this request. If not specified, any available GCS node in the endpoint will be used.
--domain DOMAIN: DNS name to use for this endpoint
--wildcard: Flag indicating that this is a wildcard domain; if true, all collections on this endpoint which don’t have custom domains will be subdomains of this domain
--managed / --unmanaged: If --managed, automatically synchronize certificates and keys between data transfer nodes using Globus services.
--private-key-path PRIVATE_KEY: Path to a file containing the PEM-encoded private key to use for this domain.
--certificate-path CERT: Path to a file containing the PEM-encoded X.509 certificate for this domain.
--certificate-chain-path CHAIN: Path to a file containing the PEM-encoded X.509 certificate chain for this domain.