[Fedora-directory-users] problem with cert for ssl on RHAS5

[Steven Jones]

8><--------
> 
> So what did I do wrong?
----
probably should only use uri and not host in /etc/openldap/ldap.conf 

yep, I can take that out....

And it's clear that 

ldap.vuw.ac.nz != cn=vuwunicvfdsm001.vuw.ac.nz (certificate)

Sorry I fail to see it as that clear (until now you explain it anyway!)

....Working through the FDS/RDS documentation I seem to have failed to
notice that it clearly (if at all???) explains what cn= should equal or
indeed the setting in the ldap.conf needs to be the same....in terms of
DNS they do equal as ldap is a CNAME of vuwunicvfdsm001....

The advantage of using a CNAME is I can upgrade the system and to a
simple CNAME change to replace the servers....

Thanks, I have changed,

#uri ldap://ldap.vuw.ac.nz/

To,

uri ldap://vuwunicvfdsm001.vuw.ac.nz/

So I now have for /etc/openldap/ldap.conf,

==========
# http://www.padl.com
#URI     ldap://ldap.vuw.ac.nz
base dc=vuw,dc=ac,dc=nz
pam_password md5
BASE dc=vuw,dc=ac,dc=nz
#tls_cacertfile /etc/openldap/cacerts/ca.crt
#TLS_REQCERT allow
TLS_REQCERT never
#host ldap.vuw.ac.nz
#host vuwunicvfdsm001.vuw.ac.nz
#ssl start_tls
#nss_base_passwd        ou=People,dc=vuw,dc=ac,dc=nz
#nss_base_shadow        ou=People,dc=vuw,dc=ac,dc=nz
 

uri ldap://vuwunicvfdsm001.vuw.ac.nz/
#uri ldap://ldap.vuw.ac.nz/
ssl no
tls_cacertdir /etc/openldap/cacerts
=========

and a working ldapsearch,

ldapsearch -x -ZZ '(uid=jonesst1)'

Gives me the correct answer....

Regards

Steven