How to use existing SSL cert?

[Sean Carolan]

Hi folks:

We already have a wildcard certificate that I want to use with our 389
directory server.  I have installed our CA certificate, but when I get
to installing our wildcard cert the GUI is asking for a password to
access the token. Is there no way to install our private key using the
GUI?  If not can it be done some other way?  I'm not keen on
purchasing an entirely new certificate when we already have one...

Thanks

Sean

[Rich Megginson]

Sean Carolan wrote:
>  Hi folks:
>
>  We already have a wildcard certificate that I want to use with our 389
>  directory server.  I have installed our CA certificate, but when I get
>  to installing our wildcard cert the GUI is asking for a password to
>  access the token. Is there no way to install our private key using the
>  GUI?  If not can it be done some other way?  I'm not keen on
>  purchasing an entirely new certificate when we already have one...
>     
What format is your existing private key/cert in?
>  Thanks
>
>  Sean
>  --
>  389 users mailing list
>  389-users(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/389-users
>

[Sean Carolan]

They are standard x.509v3, RSA 1024 bit encrypted format.   Nothing
exotic, they work fine on Apache web servers...

>  What format is your existing private key/cert in?
> > Thanks
> >
> > Sean
> > --
> > 389 users mailing list
> > 389-users(a)lists.fedoraproject.org
> > https://admin.fedoraproject.org/mailman/listinfo/389-users
> >
>
>  --
>  389 users mailing list
>  389-users(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/389-users
>

[Rich Megginson]

Sean Carolan wrote:
>  They are standard x.509v3, RSA 1024 bit encrypted format.   Nothing
>  exotic, they work fine on Apache web servers...
>     
You first need to put them in pkcs12 format.  Use the openssl pkcs12 to 
combine your existing server cert and private key into a pkcs12 file.

Then, use the pk12util to import your .p12 file into the directory server:

cd /etc/dirsrv/slapd-something
mv cert8.db cert8.db.save
mv key3.db key3.db.save
pk12util -i /path/to/your/file.p12 -d .

If you encrypted your .p12 file, you will have to give the decryption 
password.  If prompted for the NSS db password, I think you should be 
able to just hit Enter.
>    
> > What format is your existing private key/cert in?
> >     
> >> Thanks
> >>
> >> Sean
> >> --
> >> 389 users mailing list
> >> 389-users(a)lists.fedoraproject.org
> >> https://admin.fedoraproject.org/mailman/listinfo/389-users
> >>
> >>       
> > --
> > 389 users mailing list
> > 389-users(a)lists.fedoraproject.org
> > https://admin.fedoraproject.org/mailman/listinfo/389-users
> >
> >     
>  --
>  389 users mailing list
>  389-users(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/389-users
>

[Sean Carolan]

>  If you encrypted your .p12 file, you will have to give the
> decryption
>  password.  If prompted for the NSS db password, I think you should be
>  able to just hit Enter. 
This seems to have worked.  I have new cert8.db and key3.db files.  I
did the same process inside the /etc/dirsrv/admin-srv directory, and
seem to have locked myself out of some console functions.  I'm getting
"SSL related initialization failed" errors whenever I try to use any
of the console features.

[Sean Carolan]

>  This seems to have worked.  I have new cert8.db and key3.db files.
>  I
>  did the same process inside the /etc/dirsrv/admin-srv directory, and
>  seem to have locked myself out of some console functions.  I'm getting
>  "SSL related initialization failed" errors whenever I try to use any
>  of the console features. 
I fixed the console by reverting to the old cert8.db and key3.db
files.  Is there a separate process for getting ssl working with the
management console?

[Rich Megginson]

Sean Carolan wrote:
> > If you encrypted your .p12 file, you will have to give the
> decryption
> > password.  If prompted for the NSS db password, I think you should be
> > able to just hit Enter.
> >     
>
>  This seems to have worked.  I have new cert8.db and key3.db files.  I
>  did the same process inside the /etc/dirsrv/admin-srv directory, 
Do the directory
server and admin server start up correctly now?
>  and
>  seem to have locked myself out of some console functions.  I'm getting
>  "SSL related initialization failed" errors whenever I try to use any
>  of the console features.
>     
389-console -D 9
let's see exactly what it's complaining about
>  --
>  389 users mailing list
>  389-users(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/389-users
>

[Sean Carolan]

> > seem to have locked myself out of some console functions.
>  I'm getting
> > "SSL related initialization failed" errors whenever I try to use any
> > of the console features.
> >
>  389-console -D 9
>  let's see exactly what it's complaining about 
I've only got a small handful of users so I simply reinstalled from
scratch and re-created the user database.  This time around I will
snapshot the entire virtual machine before making any more major
changes.  I have the directory server working now with TLS
authentication enabled.  It's working quite well now.  I have another
question related to replication, so I'll start a new thread with a
different subject.  Thanks again for your help importing my existing
certificate!

[Rich Megginson]

Sean Carolan wrote:
> >> seem to have locked myself out of some console functions. 
> I'm getting
> >> "SSL related initialization failed" errors whenever I try to use any
> >> of the console features.
> >>
> >>       
> > 389-console -D 9
> > let's see exactly what it's complaining about
> >     
>
>  I've only got a small handful of users so I simply reinstalled from
>  scratch and re-created the user database.  This time around I will
>  snapshot the entire virtual machine before making any more major
>  changes.  I have the directory server working now with TLS
>  authentication enabled.  It's working quite well now.  I have another
>  question related to replication, so I'll start a new thread with a
>  different subject.  Thanks again for your help importing my existing
>  certificate!
>     
If you have previously run the console using TLS/SSL, and the CA cert 
has changed, it is usually a simple matter of doing rm -rf 
~/.398-console and running console again.
>  --
>  389 users mailing list
>  389-users(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/389-users
>

[Sean Carolan]

>  If you have previously run the console using TLS/SSL, and the CA
> cert
>  has changed, it is usually a simple matter of doing rm -rf
>  ~/.398-console and running console again. 
Is the process of importing a cert for the admin console the same as
the one for the directory server?  They both have cert8.db and key3.db
files.  But that is how I locked myself out the first time I tried!

[Rich Megginson]

Sean Carolan wrote:
> > If you have previously run the console using TLS/SSL, and the CA
> cert
> > has changed, it is usually a simple matter of doing rm -rf
> > ~/.398-console and running console again.
> >     
>
>  Is the process of importing a cert for the admin console the same as
>  the one for the directory server?  They both have cert8.db and key3.db
>  files.  But that is how I locked myself out the first time I tried!
>     
I'm not sure what happened - configuring TLS/SSL using the console is 
tricky, and must usually be performed in a certain order, or you can 
lock yourself out of the console.
>  --
>  389 users mailing list
>  389-users(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/389-users
>

[Sean Carolan]

> > Is the process of importing a cert for the admin console the same
> as
> > the one for the directory server?  They both have cert8.db and key3.db
> > files.  But that is how I locked myself out the first time I tried!
> >
>  I'm not sure what happened - configuring TLS/SSL using the console is
>  tricky, and must usually be performed in a certain order, or you can
>  lock yourself out of the console. 
It's ok, for now I'm just happy to have a working system with TLS
authentication.  I'll work on securing the admin console later.  Is
the process the same though?  Eg, using the pk12util -i command to
import my cert into cert8.db and key3.db?

[Rich Megginson]

Sean Carolan wrote:
> >> Is the process of importing a cert for the admin console the
> same as
> >> the one for the directory server?  They both have cert8.db and key3.db
> >> files.  But that is how I locked myself out the first time I tried!
> >>
> >>       
> > I'm not sure what happened - configuring TLS/SSL using the console is
> > tricky, and must usually be performed in a certain order, or you can
> > lock yourself out of the console.
> >     
>
>  It's ok, for now I'm just happy to have a working system with TLS
>  authentication.  I'll work on securing the admin console later.  Is
>  the process the same though?  Eg, using the pk12util -i command to
>  import my cert into cert8.db and key3.db?
>     
You shouldn't have to import any certs into the console.  See 
http://www.redhat.com/docs/manuals/dir-server/8.1/console/Starting_the_Se...
>  --
>  389 users mailing list
>  389-users(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/389-users
>

[Sean Carolan]

>  You shouldn't have to import any certs into the console.  See
>
> http://www.redhat.com/docs/manuals/dir-server/8.1/console/Starting_the_Se...
Step 2 says "Obtain and install server and CA certificates on the
Administration Server. This is a similar process as for the Directory
Server."

I guess I'm confused.  When I log on with the 389 console program I
see "Directory Server" and "Administration Server".  I imported my
certificate using the pk12util tool into /etc/dirsrv/slapd-example.
Do I also need to import the same certificate into
/etc/dirsrv/admin-serv?  Step 2 seems to be saying that is the case,
but I want to make sure it's the right thing to do.

[Rich Megginson]

Sean Carolan wrote:
> > You shouldn't have to import any certs into the console. 
> See
> >
> http://www.redhat.com/docs/manuals/dir-server/8.1/console/Starting_the_Se...
> >     
>
>  Step 2 says "Obtain and install server and CA certificates on the
>  Administration Server. This is a similar process as for the Directory
>  Server."
>     
You already have the server certificates.
>  I guess I'm confused.  When I log on with the 389 console program
> I
>  see "Directory Server" and "Administration Server".  I imported my
>  certificate using the pk12util tool into /etc/dirsrv/slapd-example.
>  Do I also need to import the same certificate into
>  /etc/dirsrv/admin-serv? 
Yes.
>  Step 2 seems to be saying that is the case,
>  but I want to make sure it's the right thing to do.
>  --
>  389 users mailing list
>  389-users(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/389-users
>

[Sean Carolan]

> > Do I also need to import the same certificate into
> > /etc/dirsrv/admin-serv?
>  Yes. 
Well, I tried following the steps, importing the same certificate into
the admin-serv directory just as I did before with the slapd-example
directory.  Each time I do this, when I go back to the console and
attempt to click on "Manage Certificates" I get an "SSL related
initialization failed".  I tried changing ownership and permissions on
the cert8.db and key3.db files but this didn't help much.

I will try and figure out how to get some console logging going on my
windows 389 console client, since the Linux one never worked for me
(the GUI was all messed up with no text on the buttons).  I'll post
the log output here if I can get it.

In the meantime if you know of a quick fix or something I'm missing
please let me know!

[Sean Carolan]

>  I will try and figure out how to get some console logging going on
> my
>  windows 389 console client, since the Linux one never worked for me
>  (the GUI was all messed up with no text on the buttons).  I'll post
>  the log output here if I can get it. 
I got this working, if anyone else needs the solution here's what I did:

Instead of importing the certificate twice, I simply copied the
cert8.db and key3.db files from /etc/dirsrv/slapd-example/ into
/etc/dirsrv/admin-serv/.  Now there are no problems and I'm able to
use https to log onto the console with the java gui client.