I was thinking about server cert but I usually put fqdn in every
certificate I made.
This is intersting problem. Can you provide output of ldapsearch with debug
plus contents of /etc/openldap/ldap.conf?
28 wrz 2012 17:20, "Kyle Flavin" <kyle.flavin(a)gmail.com> napisał(a):
I tried both tls_cacert and tls_cacertdir, same result. I think
still encrypting when I set tls_reqcert to never, because ldapsearch with
-d 1 indicates it's still doing the Start TLS negotiation, and dsniff
doesn't seem to pick up the password when I add the "-ZZ" (it grabs the pw
when I leave that off). Maybe dnsiff just doesn't "speak" Start TLS
though, and I need to look at it with wireshark to make sure the password
isn't in cleartext...
Hmm, I don't think I set the CN of the cacert to the hostname. Does it
matter if I generate multiple certs for the same host using the same
hostname for the CN? I'm using self signed certs. The server.cert which I
generated for the directory server uses the hostname for its CN so I didn't
want duplicates. I just set CN of the cacert to "ROOT CA" I think. Also,
apparently I need to generate yet another cert for the admin server. I
wanted to just reuse my server.cert from the directory server in both
places, but 389 isn't letting me do that (it says the cert was generated by
another host). This would mean I'd need yet a third certificate with a CN
set to the hostname of this same server. Again, not sure if this is a
On Thu, Sep 27, 2012 at 11:56 PM, Grzegorz Dwornicki <gd1100(a)gmail.com>wrote:
> maybe tls_reqcert never forces non ssl or it forces no ssl checks. As You
> know for example hostname must be present and valid DNS domain in CN field
> of certficace or session will fail.
> Have you tried using tls_cacert insted of cacertdir? I am writing this
> without manuals soo I am not sure: tls_cacert or tls_cacertfile
> I have learned when you have just one ca, then tls_cacertdir sometimes
> did not work as I thought it would. It did not work at all for me.
> 28 wrz 2012 07:28, "Kyle Flavin" <kyle.flavin(a)gmail.com> napisał(a):
> Yeah -- So what I did is drop cacert.asc under /tmp/ldap/certs for
>> testing purposes. I then added a line "TLS_CACERTDIR /tmp/ldap/certs"
>> /etc/openldap/ldap.conf. The logs on the directory server (and from adding
>> a -d 1 option to ldapsearch) indicated that the client was rejecting the
>> certificate. So I used certutil with cacert.asc to create the cert8.db and
>> key3.db files under /tmp/ldap/certs (I now have cacert.asc, cert8.db,
>> key3.db, and secmod.db under that directory). Same result. Then I went
>> back to /etc/openldap/ldap.conf and set "TLS_REQCERT never", and
>> out the cacertdir directive. With that configuration, ldapsearch works
>> with the -ZZ options. So for some reason, it isn't liking my CA cert, and
>> I'm not sure why.
>> On Thu, Sep 27, 2012 at 9:46 PM, Grzegorz Dwornicki
>>> Did you install ca.cert on system and setup /etc/openldap/ldap.conf ?
>>> 28 wrz 2012 05:11, "Kyle Flavin" <kyle.flavin(a)gmail.com>
>>>> Hi, I've been struggling to setup 389 Directory server with Start
>>>> I have a multi-master replication working with four server. From an
>>>> external client running openldap's ldapsearch, I'm trying to do
>>>> ldapsearch -ZZ -x -h "myserver" -b
>>>> "cn=Directory Manager" -W ""
>>>> I get an unsupported protocol error on servers that do not have
>>>> certificates installed.
>>>> In an attempt to resolve this, I tried to install a self-signed cert.
>>>> I created a ca.cert and a server.crt, and imported them into the
>>>> Server. I then imported the ca.cert to the admin server. When I
>>>> to import the same server.crt to the admin server, I got an error
>>>> stating the certificate was for another host. Since the admin server
>>>> directory server reside on the same host, if I generate a new request,
>>>> will have an identical host name (I'm not sure if that's relevant
>>>> issue). After all of that, I now receive a "Connect Error
>>>> SSL3_GET_SERVER_CERTIFICATE:certificate verify failed". I'm
>>>> need to import the root cert onto the client somehow, but I'm not
>>>> to go about doing that.
>>>> This has become pretty time consuming, so I was hoping that someone
>>>> more knowledgeable could confirm that I'm at least travelling down
>>>> right path. I've been following this Red Hat document:
>>>> 389 users mailing list
>>> 389 users mailing list
>> 389 users mailing list
> 389 users mailing list
389 users mailing list