Hello,
I am trying to setup a mutual based TLS authenticated 389-DS LDAP server, where the client
and the server will perform certificate based authentication.
This should be test system and not a production system.
I have a Windows CA signed on the LDAP server certificate and the client certificate
(.p12). The server has its the CA root and its own cert loaded:
[root@ldap2sit slapd-ldap2sit]# certutil -K -d .
certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key
and Certificate Services"
< 0> rsa 90f72656c6c26fad75fbc5787105197301d76bab Server-Cert
[root@ldap2sit slapd-ldap2sit]#
[root@ldap2sit slapd-ldap2sit]#
[root@ldap2sit slapd-ldap2sit]# certutil -L -d .
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
Server-Cert u,u,u
ca_cert C,,
I have a client defined in the LDAP:
uid=a47886b9fffc , cn=a47886b9fffc , o=Avaya , l=Holon, mail=eshmulen(a)avaya.com
The certificate I have on the client is:
Issued to: a47886b9fffc
Issued by: sititcdc (which is the same CA signed the server certificate and its root in
loaded to the server)
Issuer: cn=sititcdc,dc=sititc,dc=dom
Subject: e=eshmulen(a)avaya.com, cn=a47886b9fffc, ou=SIT, o=Avaya, L=Holon, S=Israel, C=IL
My /etc/dirsrv/ldap2sit/certmap.conf:
certmap ldap2sit o=Avaya,l=Holon
ldap2sit:DNComps
ldap2sit:FilterComps cn
ldap2sit:verifycert on
When trying connecting I get connection failure with with following entries in
/var/log/dirsrv/.../error:
[02/Apr/2019:20:33:11.096582067 +0300] conn=5 fd=64 slot=64 SSL connection from
149.49.161.10 to 149.49.78.110
[02/Apr/2019:20:33:11.139068683 +0300] conn=5 Netscape Portable Runtime error -8172
(Peer's certificate issuer has been marked as not trusted by the user.);
unauthenticated client
E=eshmulen(a)avaya.com,CN=a47886b9fffc,OU=SIT,O=Avaya,L=Holon,ST=Israel,C=IL; issuer
CN=sititcdc,DC=sititc,DC=dom
[02/Apr/2019:20:33:11.139131964 +0300] conn=5 op=-1 fd=64 closed - Peer's certificate
issuer has been marked as not trusted by the user.
In wireshark trace I see the server is closing the TCP/TLS connection with alert (Level:
Fatal, Description: Unknown CA)
Can you tell me what I am doing wrong here?
Thanks,
Eli