These instructions describe how to install a replacement cert using firefox on spartha.  If you need to install a certificate from scratch please start below the pound signs.

0. Back up .globus/ directory.

1. Log on to spartha and open firefox.

2. Go to https://pki1.doegrids.org:443 as indicated in the email from doegrids.

3. Click on "replacement certificate" on the left hand side.

4. Click on "submit."  I got an error message the first time I tried this, but it worked the second time.  If it works, you will get a screen with the words "-----BEGIN CERTIFICATE-----" followed by a bunch of letters.

5. Then, in Firefox>Edit>Preferences>Advanced>View Certificates
   click on BackUp to create a .p12 file.

6. Then,
   openssl pkcs12 -in eric.p12 -clcerts -nokeys -out .globus/usercert.pem
   openssl pkcs12 -in eric.p12 -nocerts -out .globus/userkey.pem

7. Finally:
   chmod go-rw .globus/userkey.pem

###########################################################################################################

Instructions for installing DOE grid cert.

Go to: http://pki1.doegrids.org
Select "Retrieval" tab
Select "Import CA Certificate Chain" from the menu.
Under "Users", select the radio button "Import CA Certificate Chain into your browser".
Click the "Submit" button.

openssl pkcs12 -export -out ericcert.p12 -in usercert.pem -inkey  userkey.pem

Now open a firefox and get to the 'Certificate Manager'
- Choose from Firefox -- Edit -- Preferences -- Advanced -- Encryption
- and then Choose 'View Certificates'
- You should see pop-up windows with multiple tabs and select 'Your Certificates' tab
- Click on 'Import' and point to the ericcert.p12 file
you will be asked to provide password to verify. If successful you should see your certificate listed under
'Your Certificates'.
If you don't see your certificate, then please tell us if you get any error.

Please restart the browser at this time, to clear any cache issue.

You also need to verify the trust settings for the DOEGrids CA Chain.
0. Choose from Firefox -- Edit -- Preferences -- Advanced -- Encryption
1. and then Choose 'View Certificates'
2. Select 'Certificate Authorities' tab and scroll down the list and look for 'DOEGrids CA 1' and 'ESnet Root
CA 1'; both of them should be grouped under 'ESnet'
3. Select 'ESnet Root CA 1' and click 'Edit' you should get a pop-up with 3 types of trust settings;
Check(select) all three types if those were unchecked. Click 'OK'.
4. Select 'DOEGrids CA 1' and click 'Edit' you should get a pop-up with 3 types of trust settings;
Check(select) all three types if those were unchecked. Click 'OK'.

Now your browser should be configured and ready to use the 'Replacement Certificate' interface.

now go to https://pki1.doegrids.org:443, and click on "replacement certificate"
Click submit, etc..

Then, in Firefox>Edit>Preferences>Advanced>View Certificates
      click on BackUp to create a .p12 file.

Then:
openssl pkcs12 -in YourCert.p12 -clcerts -nokeys -out .globus/usercert.pem
openssl pkcs12 -in YourCert.p12 -nocerts -out .globus/userkey.pem

Finally:
chmod go-rw .globus/userkey.pem