Date: Tue, 21 Oct 2014 13:29:32 +0200 From: Graham Leggett minfrin@sharp.fm
Hi all,
I am trying to research how it might be possible to do a directory search
for an exact match on a digital certificate storing in userCertificate. Most specifically, I want to do a simple lookup based on a binary match of the cert, its not enough to do the combination of DN and serial number.
Does anyone know whether a simple search will work with 389ds or if there
are any gotchas to look out for? Some googling would suggest that openldap can’t do it, I was wondering if 389ds had the same problem.
The userCertificate attribute is defined in RFC4523 with a specific syntax, and only supports the certificateExactMatch matching rule. OpenLDAP implements this RFC, along with the rest of the LDAPv3 spec.
In the past, before the certificateExactMatch matching rule was defined (LDAPv2 days), it was common practice to change the core.schema definition of userCertificate to use octetString syntax, and the corresponding octetStringMatch equality matching rule. You can still do this in OpenLDAP, although it obviously breaks compatibility with the standards.
389-users@lists.fedoraproject.org