Having read all the manuals and snippets I can find, I have come up with the following certmap.conf file:
certmap default default
What I want the above to do is this:
- Look up the subject of the client certificate as the DN in the nsCertSubjectDN attribute.
- Also do an exact match of the certificate in the userCertificate attribute (verifycert on).
- Do the search across all contexts.
Does the certmap above do this?
What is not working for me is the lookup:
[18/Nov/2020:00:10:33.787682853 +0200] conn=1269 TLS1.3 128-bit AES-GCM; client serialNumber=365[snip]a14,CN=host.example.com; issuer CN=X,O=Y,C=UK
[18/Nov/2020:00:10:33.888476161 +0200] conn=1269 TLS1.3 failed to map client certificate to LDAP DN (No such object)
Looking at the source code, the above message is logged if we have a certificate, but we didn’t manage to map a DN:
Something missing from the documentation is the DN format expected by the nsCertSubjectDN attribute.
Is the format CN=X,serialNumber=Y as reported by openssl x509, or is it serialNumber=Y,CN=X as reported by the log message above?