GT2 and GT3 services were set up to run with root owned host credentials. In GT4 most, but not all, services will run as the globus user. To allow the globus user to start services using host credentials the globus user needs to be able to access them. This requirement can be satisfied by making a copy of the root owned host credentials, i.e. the host certificate and private key, owned by the globus user. In GT4 this copy is assumed to be /etc/grid-security/container{cert,key}.pem.

The information from Migrating from GT2 applies to migrating from GT3 as well.