On 05/19/2011 08:56 AM, solarflow99 wrote:
I'm trying to configure replication over SSL using StartTLS, I don't see any example of how to export/import self signed certs into the slave.  Here's what I did:
created a CA cert and server cert on the master, everything is fine.  exported the CA cert and copied it to the slave:


[root@ldapslave]# certutil -A -d . -n "CA certificate" -t "CT,," -a -i cacert.asc

[root@ldapslave]# certutil -d . -L

Certificate Nickname                                         Trust Attributes
                                                             SSL,S/MIME,JAR/XPI

CA certificate                                               CT,,



What is next?  I tried everything I could think of..
The SSL roles are _opposite_ the master/slave roles.  The master pushes changes to the slave.  So in this instance, the _slave_ is the SSL _server_, and the _master_ is the SSL _client_.
In order to be an SSL server, the slave must have a server cert/key and CA cert.
In order to be an SSL client, the master must have just the CA cert.

-- 389 users mailing list 389-users@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/389-users