On ke, 21 elo 2019, Jonathan Vaughn via FreeIPA-users wrote:
>Ah, I didn't realize I could do SSL termination in TCP mode. That would
>certainly solve our LDAP HA problem with less effort! I'll try that.
Note that FreeIPA doesn't really use LDAPS (and there is no such thing
as LDAPS in protocol specs, it was never formalized). FreeIPA uses
startTLS in LDAP -- at least SSSD will actively rely on it. Also Windows
doesn't allow use of LDAPS+GSSAPI.
>
>On Wed, Aug 21, 2019 at 8:27 PM Daniel Oetken via FreeIPA-users <
>freeipa-users@lists.fedorahosted.org> wrote:
>
>> Why doesn’t terminating SSL on the proxy work with LDAPS? Because it
>> should, and says so too here:
>> https://www.mail-archive.com/haproxy@formilux.org/msg21657.html
>>
>>
>> Though, I’m looking into the same thing to add SAN to the server
>> certificate and wondering about similar questions. When you look at
>> “ipa-getcert list” you should see the current certificates already,
>> including their settings, so I was thinking to just stop tracking those old
>> ones and create new ones like you did, except with the exact same options
>> as the old ones (+ SAN). But yeah, I’m not sure if there is anything else
>> involved, or if there is a better way. I only started using freeipa
>> recently.
>> _______________________________________________
>> FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
>> To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
>> Fedora Code of Conduct:
>> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>> List Archives:
>> https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
>>
>_______________________________________________
>FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
>To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
>Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland