The Grid utilizes public key or asymmetric cryptography for authentication of users, resources and services (about cryptography see the RSA FAQ). According to the basics of public-key cryptography, each resources on the GRID has a key pair, a public and a private key. The public key is made public while the private key must be kept secret. Encryption and authorization is performed using the public key while decryption and digital signature is performed with the private key. It is important to notice that generating a key pair does not automatically provide you access to the Grid resources. A trusted authority of the Grid, called the Certificate Authority (CA) needs to sign your key pair this way confirming your identity. This signing procedure of the CA is often referred as issuing a certificate.
Within the Globus era the key file (userkey.pem) and the certificate file (usercert.pem) corresponds to the key pair of the public-key cryptography. The userkey.pem file (or resourcekey.pem) contains the private key encrypted with your password (called pass phrase in Globus). The certificate file (usercert.pem) contains your public key together with additional important informations such as the subject name of the holder of the certificate, the name of the signing CA, and the digital signature of the CA. The important role of the CA is to establish a trustful connection between the identity of the user and the public key in the certificate file. The digital signature of the CA in the user's certificate file officially declares that the public key in the file belongs to the specific user (subject name). The certificate files are encoded with the x.509 format.
In order to obtain a valid passport to the Grid you need to create a key pair and submit your public key to the CA (this process is called as a certificate request) for a signature. The CA will follow its certificate policy and upon successful evaluation of your request your public key will be signed and posted back to you. As it was mentioned before all resources (i.e. gatekeepers, users, services) require a CA-signed key pair to be able to operate on the Grid.
The globus-certreq (or grid-cert-request) command creates an unsigned key pair in your .globus directory. The userkey.pem holds your private key encoded with your pass phrase (you are prompted to supply this pass phrase during the key pair generation). This file must only be readable by its owner. The usercert_request.pem file contains your unsigned public key together with your subject name and the name of your default CA. This file should be mailed to the CA. The globus-certreq creates an empty usercert.pem file as well, you can later save your CA-signed certificate into this file. Please always remember that a Grid passport consists of two files, the private key file and the public certificate file, you need to have both of them, the certificate file (usercert.pem) alone is not enough for the Grid. If you loose one of your key files then you need to regenerate a new CA-signed key pair.
You can use the openssl cryptography toolkit and the Globus provided commands to create, check, convert between different formats, manipulate your certificate files (actually the Globus commands are just a friendly interface to the openssl toolkit). For further information please read the openssl, verify, x509 man pages, or use the Globus commands with the -help option.