<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
On 5/25/2012 9:41 PM, Jeff Field wrote:
<blockquote
cite="mid:CACuS6wvaUy2eJc+hN5Sv8xNa0rde8HxT-wocL=3J6zv5+0rc-g@mail.gmail.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
Hello,<br>
I'm attempting to use a Wildcard SSL certificate for my domain
with 389ds. The certificate and the CA (godaddy) intermediate cert
import fine into both the admin server and the directory server,
but attempts to use an <a class="moz-txt-link-freetext" href="LDAPS://">LDAPS://</a> URI with ldapmodify result in this
error:<br>
<br>
ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)<br>
<br>
curl gets this:<br>
<br>
curl: (51) SSL: certificate subject name '*.<a
moz-do-not-send="true" href="http://mydomain.com">mydomain.com</a>'
does not match target host name '<a moz-do-not-send="true"
href="http://myserver.ldap.mydomain.com">myserver.ldap.mydomain.com</a>'<br>
<br>
Am I not able to use a wildcard SSL cert in this instance? If that
is the case, what would my best course of action be?<br>
</blockquote>
<br>
The problem here isn't that you're using a wildcard certificate,
it's that your wildcard certificate truly does not match your server
name.<br>
<br>
The "*" in a wildcard certificate does not allow you to span
subdomains. *.mydomain.com would match for ldap.mydomain.com, but
if you add further names below that, it won't match.
*.ldap.mydomain.com would match and probably work correctly for you,
given the hostname you are using.<br>
</body>
</html>