The Windows CA cert is what you need to import not the cert used for the AD server.

If that doesn't work you have three choices

1) fix the certificate authority on your AD server.

2) get a wild card cert from a external "reputable" source such as VeriSign or godaddy and use that for all your SSL and TLS needs.

3) create your own CA with some thing like openssl, tinyca, or dogtag pki. The uses that for all of your SSL and TLS neads.

By the way if any one wants to know why reputable is I quotes VeriSign once gave some one who walked into their office with no ID who claimed they worked for Microsoft, Microsoft's signing (the private one you never give out) with the password.


-- Sent from my HP Pre3


On Mar 28, 2013 6:05 AM, alexandre <axel0felix@gmail.com> wrote:

Hello,

I want to Configure the Password Sync Service and do this command (in /etc/dirsrv/slapd-instance):
"certutil -d . -L -n "CA certificate" -a > dsca.crt"

But "CA certificate" doesn't exist. As I can see in web: 

" /etc/dirsrv/slapd-[instance name]
This is where the certificates for the directory instance are stored, as well as its pin.txt file. "

So I can't export server certificate on my Windows server.

Thanks in advance !