src/com/netscape/admin/dirserv/dirserv.properties | 2 ++
src/com/netscape/admin/dirserv/panel/EncryptionPanel.java | 5 +++++
2 files changed, 7 insertions(+)
New commits:
commit 9e2afe525ce807b7e63e72bc71135dc1ea92ed0d
Author: Nathan Kinder <nkinder(a)redhat.com>
Date: Tue Mar 8 12:42:04 2011 -0800
Bug 533505 - Warn about CA cert trust when enabling SSL in Console
This patch adds a warning dialog when one enables encryption for
Directory Server through the Console. The warning states that the
CA certificate chain that issued the server cert must be trusted
before restarting DS.
diff --git a/src/com/netscape/admin/dirserv/dirserv.properties
b/src/com/netscape/admin/dirserv/dirserv.properties
index 3aa360a..90b56bd 100644
--- a/src/com/netscape/admin/dirserv/dirserv.properties
+++ b/src/com/netscape/admin/dirserv/dirserv.properties
@@ -1778,6 +1778,8 @@ encryption-confirm-clientauth-title=Require Client Authentication
encryption-confirm-clientauth-msg=When the server is configured to require SSL client
authentication,\nConsole cannot use SSL to manage the server.\nIt will use a regular LDAP
connection.
encryption-confirm-sslport-title=Encrypted Port Checking
encryption-confirm-sslport-msg=The encrypted port is %0. On Unix, using a port\nbelow
1024 requires the server to be installed as root.\n\nBefore restarting the server, make
sure it was installed\nas root or set a port above 1024 using the Settings tab.
+encryption-warn-ca-chain-trust-title=Certificate Authority Trust
+encryption-warn-ca-chain-trust-msg=Ensure that the CA certificate chain for the CA
that\nissued your server certificate has been imported\nand trusted before restarting your
Directory Server.\n\nThe Directory Server will not start successfully\nif the CA
certificate chain is not trusted.
# Cipher suites
ciphers-title=Encryption Preferences
diff --git a/src/com/netscape/admin/dirserv/panel/EncryptionPanel.java
b/src/com/netscape/admin/dirserv/panel/EncryptionPanel.java
index 0e7ad9f..e131bf4 100644
--- a/src/com/netscape/admin/dirserv/panel/EncryptionPanel.java
+++ b/src/com/netscape/admin/dirserv/panel/EncryptionPanel.java
@@ -273,6 +273,11 @@ public class EncryptionPanel extends BlankPanel
// Warn the user he needs to restart the server
DSUtil.showInformationDialog(frame, "requires-restart", (String)null);
+
+ // If they are enabling encryption, warn them to trust the CA chain too
+ if (_configData.sslServerOn) {
+ DSUtil.showInformationDialog(frame, "warn-ca-chain-trust", (String)null,
_section);
+ }
/* Warn the user: port below 1024 require root install on unix */
if (_configData.sslServerOn && !DSUtil.isNT(consoleInfo)) {