MIssing schemas?
by Crocker, Deborah
I just loaded version 1.3.8.4 on a Centos7 system (yum install 389-ds, which brings it all in) and there are no schemas deployed with the directory. There is only 99user.ldif which has the skeleton entries.
I've never seen this happen before. I don't see them as a separate package. I could bring over the full set of schema files from the directory setup we will be migrating from but those were on a 1.2 x directory and I don't know if something in the basic schemas has changed.
Any thoughts on how to get them?
Thanks
D. Crocker
Deborah Crocker, PhD
Systems Engineer III
Office of Information Technology
The University of Alabama
Box 870346
Tuscaloosa, AL 36587
Office 205-348-3758 | Fax 205-348-9393
deborah.crocker(a)ua.edu
5 years
- 4
- 6
Peer's certificate issuer has been marked as not trusted by the user
by Eli
Hello,
I am trying to setup a mutual based TLS authenticated 389-DS LDAP server, where the client and the server will perform certificate based authentication.
This should be test system and not a production system.
I have a Windows CA signed on the LDAP server certificate and the client certificate (.p12). The server has its the CA root and its own cert loaded:
[root@ldap2sit slapd-ldap2sit]# certutil -K -d .
certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services"
< 0> rsa 90f72656c6c26fad75fbc5787105197301d76bab Server-Cert
[root@ldap2sit slapd-ldap2sit]#
[root@ldap2sit slapd-ldap2sit]#
[root@ldap2sit slapd-ldap2sit]# certutil -L -d .
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
Server-Cert u,u,u
ca_cert C,,
I have a client defined in the LDAP:
uid=a47886b9fffc , cn=a47886b9fffc , o=Avaya , l=Holon, mail=eshmulen(a)avaya.com
The certificate I have on the client is:
Issued to: a47886b9fffc
Issued by: sititcdc (which is the same CA signed the server certificate and its root in loaded to the server)
Issuer: cn=sititcdc,dc=sititc,dc=dom
Subject: e=eshmulen(a)avaya.com, cn=a47886b9fffc, ou=SIT, o=Avaya, L=Holon, S=Israel, C=IL
My /etc/dirsrv/ldap2sit/certmap.conf:
certmap ldap2sit o=Avaya,l=Holon
ldap2sit:DNComps
ldap2sit:FilterComps cn
ldap2sit:verifycert on
When trying connecting I get connection failure with with following entries in /var/log/dirsrv/.../error:
[02/Apr/2019:20:33:11.096582067 +0300] conn=5 fd=64 slot=64 SSL connection from 149.49.161.10 to 149.49.78.110
[02/Apr/2019:20:33:11.139068683 +0300] conn=5 Netscape Portable Runtime error -8172 (Peer's certificate issuer has been marked as not trusted by the user.); unauthenticated client E=eshmulen(a)avaya.com,CN=a47886b9fffc,OU=SIT,O=Avaya,L=Holon,ST=Israel,C=IL; issuer CN=sititcdc,DC=sititc,DC=dom
[02/Apr/2019:20:33:11.139131964 +0300] conn=5 op=-1 fd=64 closed - Peer's certificate issuer has been marked as not trusted by the user.
In wireshark trace I see the server is closing the TCP/TLS connection with alert (Level: Fatal, Description: Unknown CA)
Can you tell me what I am doing wrong here?
Thanks,
Eli
5 years
- 3
- 4