On 03/07/2012 06:34 AM, Luigi Santangelo wrote:
Hi guru,
i have a problem with enabling SSL in my Fedora Directory Server. I
already searched with google and I have found other people that have
same problem but, following the instructions, I cannot resolve my
problem (maybe my problem has a different source).
I start by saing that in the past I have enabled SSL on FDS 1.2.5
succesfully, but with FDS 1.2.12 rc2 I cannot.
I'm assuming you mean 1.2.10.rc2 - Don't use rc2 - use 1.2.10.3 which is
in updates-testing
On my Fedora 16, with kernel 3.2.7-1, I installed FDS 1.2.12rc2. Then,
I created a request for the Directory Server (using Manage
Certificates). During this operation, I inserted the FQDN in Server
Name field and I completed other field (Organization, State, etc).
Then I exported the request and, using a my self-signed CA, I created
a cert for the server. I imported server and CA certs succesfully. In
the Certification Path tab of server cert, I can see the correct chain
(server and ca certs). But when I enable SSL for my server (with
Encryption tab) and I restart my server, it cannot start correctly and
give me this error:
SSL alert: Security Initialization: Unable to authenticate (Netscape Portable Runtime
error -8192 - An I/O error occurred during security authorization.)
ERROR: SSL Initialization Failed.
But if I create a key and cert with openssl for my server (then not
creating the request and sign it, but creating the cert directly with
openssl), I export the cert in p12 format and I import it with
certutil utility, it works fine: I can enable SSL and I can restart my
server without any problem.
Then, I thing that I wrong to insert the information during generation
request. Can you help me?
You should also use 389-admin-1.1.27 from updates-testing - there was a
similar bug fixed in 389-admin
Another question (mere curiosity): why RedHat Directory Server and
Fedora Directory Server have different version number? Its doesn't
offer the same features? Thanks
389 (formerly Fedora Directory Server) is the upstream open source
project which changes frequently and has new features as soon as they
are developed. Red Hat Directory Server is the downstream product which
does not change as frequently, and only gets new features once they are
tested, documented, and support ready.
--
389 users mailing list
389-users(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/389-users