[389-users] Trouble using self signed certificates.

jean-Noël Chardron Jean-Noel.Chardron at dr15.cnrs.fr
Thu Jun 25 08:25:06 UTC 2009


John A. Sullivan III a écrit :
> On Wed, 2009-06-24 at 18:55 +0200, Jean-Noel Chardron wrote:
>   
>> Dumbo Q a écrit :
>>     
>>> I've managed to get past the the strangely obscure method of 
>>> installing an SSL certificate, and from the server side everything 
>>> appears to be OK. Actually its a "CACert" certificate, rather then 
>>> self signed. Using Jxplorer, I can connect the the DS using SSL, 
>>> accept the certificate, and I'm all set.
>>>
>>> However, I am having a ton of trouble figuring out how to use an 
>>> untrusted ca for my linux user authentication. I changed 
>>> /etc/ldap.conf to use ldaps://, and it attemtps to connect as 
>>> expected. I think this would work, if I could figure out how to tell 
>>> it to accept the certificate. I get the following error message in DS 
>>> after running getent passwd.
>>>
>>> [24/Jun/2009:12:24:02 -0400] conn=3 op=-1 fd=66 closed - Peer does not 
>>> recognize and trust the CA that issued your certificate.
>>> [24/Jun/2009:12:24:02 -0400] conn=4 op=-1 fd=67 closed - Peer does not 
>>> recognize and trust the CA that issued your certificate.
>>>
>>>
>>> Any thoughts?
>>>
>>>       
>> I think you have to use the directive TLS_CACERT or TLS_CACERT_DIR in 
>> /etc/ldap.conf
>> man ldap.conf :
>> TLS_CACERT <filename>
>> Specifies the file that contains certificates for all of
>> the Certificate Authorities the client will recognize.
>>
>> TLS_CACERTDIR <path>
>> Specifies the path of a directory that contains Certifi‐
>> cate Authority certificates in separate individual files.
>> The TLS_CACERT is always used before TLS_CACERTDIR. This
>> parameter is ignored with GNUtls.
>>
>>     
>>> <snip>
>>>       
> I think these may be the wrong variables.  If I recall correctly, those
> variables are for /etc/openldap/ldap.conf and control openldap (and
> openldap related queries).  pam uses /etc/ldap.conf.  I believe the
> variables are set like this:
>
> ssl start_tls
> tls_checkpeer yes
> tls_cacertfile /usr/share/ca-certificates/CA.pem
>
> or whatever the path happens to be.  Again, I'm not an expert - just
> sharing what we did that worked - John
>   
that's correct
I apologize, I made a mistake

-- 
Jean-Noel Chardron






More information about the 389-users mailing list