[389-users] problem with SSL

[remy d1]

Hi list,

I have followed the instructions of the SSL Howto, but I am still stick at
the SSL activation.

> From a clean installation, I try to launch the setupssl.sh script, but
> at 
the end, I have

ldapmodify: invalid format (line 11) entry: "cn=encryption,cn=config"


There is not specific configuration except that I use the port 9831 for my
DS instead of 389 (I already use the standard LDAP port for OpenLDAP and I
do not want to migrate (it is for testing)). I have modified the setupssl
script to execute on this port.

If I just try the end of the script, you can see the error :

ldapmodify -x -h localhost -p 9831 -D "cn=Directory Manager" -W <<EOF
dn: cn=encryption,cn=config
changetype: modify
replace: nsSSL3
nsSSL3: on
-
replace: nsSSLClientAuth
nsSSLClientAuth: allowed
-
add: nsSSL3Ciphers
nsSSL3Ciphers:
-rsa_null_md5,+rsa_rc4_128_md5,+rsa_rc4_40_md5,+rsa_rc2_40_md5,
+rsa_des_sha,+rsa_fips_des_sha,+rsa_3des_sha,+rsa_fips_3des_sha,+fortezza,
+fortezza_rc4_128_sha,+fortezza_null,+tls_rsa_export1024_with_rc4_56_sha,
+tls_rsa_export1024_with_des_cbc_qsha

dn: cn=config
changetype: modify
add: nsslapd-security
nsslapd-security: on
-
replace: nsslapd-ssl-check-hostname
nsslapd-ssl-check-hostname: off
-
replace: nsslapd-secureport
nsslapd-secureport: 636

dn: cn=RSA,cn=encryption,cn=config
changetype: add
objectclass: top
objectclass: nsEncryptionModule
cn: RSA
nsSSLPersonalitySSL: Server-Cert
nsSSLToken: internal (software)
nsSSLActivation: on

EOF

Enter LDAP Password:
ldapmodify: invalid format (line 11) entry: "cn=encryption,cn=config"


I have checked every part of these ldif data. The error is here :

nsSSL3Ciphers:
-rsa_null_md5,+rsa_rc4_128_md5,+rsa_rc4_40_md5,+rsa_rc2_40_md5,
+rsa_des_sha,+rsa_fips_des_sha,+rsa_3des_sha,+rsa_fips_3des_sha,+fortezza,
+fortezza_rc4_128_sha,+fortezza_null,+tls_rsa_export1024_with_rc4_56_sha,
+tls_rsa_export1024_with_des_cbc_qsha


But if I do the modifications except this piece of code, ldaps can be
started on the port 636, but the cert files could not be loaded from dirsrv,
so I can not do any request in SSL... I also try to :
 - edit dse.ldif file in the dirsrv DS configuration directory and delete
the line corresponding to the cert files as Red Hat documentation tells
(after stoping dirsrv service). We can see that dirsrv reload the cert files
in the dse.ldif file, but it changed nothing.
 - delete every *.db and *.txt files and cacert.csa. Then, if I reexecute
setupssl.sh, it generates the cert files, but (again), there is no
changes...

Obviously, if I open 389-console, I could see this string in the properties
of "cn=encryption,cn=config".

I have checked my real hostname and other stuffs specified in the
documentation... I know that I do not use the standard LDAP port but I do
not see why this section could not work... Other ldap request on this port
work.

Sorry for my bad english...

Any help would be gracefull !

Regards;

Rémy