[389-users] Problems with SSL

[Rob Crittenden]

Ski Kacoroski wrote:
> Rich,
> 
> Thanks very much for your replies.  I tried again with no luck.  I had 
> it working with the self-signed cert using setupssl2.sh.  I changed the 
> password on the database to one I could type and verified that it worked 
> ok.  I then added in my star cert, removed the self-signed certs, and 
> stopped the services.  When I tried to restart I get this error:
> 
> [root at ldaptest slapd-nsd-org]# service dirsrv start
> Starting dirsrv:
>      nsd-org...[03/Mar/2010:09:09:25 -0800] - SSL alert: Security 
> Initialization: Can't find certificate (CA certificate) for family 
> cn=RSA,cn=encryption,cn=config (Netscape Portable Runtime error -8174 - 
> security library: bad database.)
> [03/Mar/2010:09:09:25 -0800] - SSL alert: Security Initialization: 
> Unable to retrieve private key for cert CA certificate of family 
> cn=RSA,cn=encryption,cn=config (Netscape Portable Runtime error -8174 - 
> security library: bad database.)
> [03/Mar/2010:09:09:25 -0800] - SSL failure: None of the cipher are valid
> [03/Mar/2010:09:09:25 -0800] - ERROR: SSL Initialization phase 2 Failed.
>                                                             [FAILED]
>    *** Warning: 1 instance(s) failed to start
> 
> I use digicert as my authority.  They have options for the certs when I 
> get them (e.g. Apache, Tomcat, Java, etc.).  I have been choosing Apache 
> and it seems to install just fine.  Perhaps I need to choose a different 
> type?
> 
> It looks like by adding in my cert and removing my old certs, it trashed 
> the database somehow.
> 
> certutil -P ldaptest -d . -L
> certutil: function failed: security library: bad database.
> 
> I am going to do another reinstall and try again.  Do you know of any 
> documentation for using non-self-signed certs with 389 directory server 
> all the docs I find are for self-signed certs.

The problem is in the error message: Unable to retrieve private key for 
cert.

You need the private key for this certificate. The easiest way to load 
it into NSS using the PKCS#12 format, as Rich suggested. If you have the 
key and cert stored as PEM files, common with openssl, see the openssl 
pkcs12 man page.

rob