[389-users] Trouble using self signed certificates.

[Jean-Noel Chardron]

Dumbo Q a écrit :
> I've managed to get past the the strangely obscure method of 
> installing an SSL certificate, and from the server side everything 
> appears to be OK. Actually its a "CACert" certificate, rather then 
> self signed. Using Jxplorer, I can connect the the DS using SSL, 
> accept the certificate, and I'm all set.
>
> However, I am having a ton of trouble figuring out how to use an 
> untrusted ca for my linux user authentication. I changed 
> /etc/ldap.conf to use ldaps://, and it attemtps to connect as 
> expected. I think this would work, if I could figure out how to tell 
> it to accept the certificate. I get the following error message in DS 
> after running getent passwd.
>
> [24/Jun/2009:12:24:02 -0400] conn=3 op=-1 fd=66 closed - Peer does not 
> recognize and trust the CA that issued your certificate.
> [24/Jun/2009:12:24:02 -0400] conn=4 op=-1 fd=67 closed - Peer does not 
> recognize and trust the CA that issued your certificate.
>
>
> Any thoughts?
>
I think you have to use the directive TLS_CACERT or TLS_CACERT_DIR in 
/etc/ldap.conf
man ldap.conf :
TLS_CACERT <filename>
Specifies the file that contains certificates for all of
the Certificate Authorities the client will recognize.

TLS_CACERTDIR <path>
Specifies the path of a directory that contains Certifi‐
cate Authority certificates in separate individual files.
The TLS_CACERT is always used before TLS_CACERTDIR. This
parameter is ignored with GNUtls.

> ------------------------------------------------------------------------
>
> --
> 389 users mailing list
> 389-users at redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>