Senior Linux/Unix/San/Vmware System Administrator
APG -Technology Integration Team
Victoria University of Wellington
Phone: +64 4 463 6272
[mailto:email@example.com] On Behalf Of Craig
Sent: Wednesday, 5 December 2007 4:42 p.m.
To: General discussion list for the Fedora Directory server project.
Subject: RE: [Fedora-directory-users] problem with cert for ssl on RHAS5
On Wed, 2007-12-05 at 16:12 +1300, Steven Jones wrote:
> So what did I do wrong?
probably should only use uri and not host in /etc/openldap/ldap.conf
yep, I can take that out....
And it's clear that
ldap.vuw.ac.nz != cn=vuwunicvfdsm001.vuw.ac.nz (certificate)
Sorry I fail to see it as that clear (until now you explain it
....Working through the FDS/RDS documentation I seem to have failed to
notice that it clearly (if at all???) explains what cn= should equal
indeed the setting in the ldap.conf needs to be the same....in terms
DNS they do equal as ldap is a CNAME of vuwunicvfdsm001....
The advantage of using a CNAME is I can upgrade the system and to a
simple CNAME change to replace the servers....
Thanks, I have changed,
So I now have for /etc/openldap/ldap.conf,
and a working ldapsearch,
ldapsearch -x -ZZ '(uid=jonesst1)'
Gives me the correct answer....
just a thought (and it may be in the cert documentation for fds)
sometimes you can use subjectAltName to add more names/aliases for the
same system and then there isn't the collision when using the
certificate. I know that the openldap client software is fine with
Lastly, you probably can add to both /etc/ldap.conf
and it should automatically use tls...
ldapsearch -x '(uid=jonesst1)' would be the same as if you added -ZZ
Fedora-directory-users mailing list