The ldapsearch command doesn't look in /var/ldap for the cert db. It uses the current directory as the default cert db path. You can run ldapsearch from /var/ldap, or give it a "-P /var/ldap" argument to use the cert db in /var/ldap. Also, the -v arg might help you narrow down what's happening. Note that the Solaris ldap_cachemgr (i.e., the ldap name service client) daemon DOES use /var/ldap as its default directory to find cert db files. Also, Solaris 8 and 9 are very picky about which cert DB version they can use for ldap name service over SSL: it MUST be cert7.db as generated by earlier versions of the NSS tools. Solaris 10 might be able to use cert8.db. Susan wrote: > Hi, all. I've ssl enabled in FDS: > > # ldapsearch -D "cn=Directory Manager" -w adminpass -b "cn=encryption,cn=config" -h cnyitlin02 > cn=* > version: 1 > dn: cn=encryption,cn=config > objectClass: top > objectClass: nsEncryptionConfig > cn: encryption > nsSSLSessionTimeout: 0 > nsSSLClientAuth: allowed > nsSSL2: off > nsSSL3: on > nsSSL3Ciphers: +rsa_rc4_128_md5,+rsa_3des_sha,+fortezza_null,-rsa_null_md5,+fo > > Currently, I have authenticationMethod: simple in my default profile. I can ssh/telnet w/o > problems, authenticating from FDS (thank you, Gary Tay!) > > I've been having a real hard time getting Solaris SSL to work, however. I did the whole mozilla > cert import thing, got the cert8.db (it's not 7), and key3.db, put them in /var/ldap > > However, even though this returns data: > > -bash-3.00# ldapsearch -b "dc=composers,dc=company,dc=com" -h cnyitlin02 -L "objectclass=*" -p > 636 -Z > version: 1 > dn: dc=composers,dc=company,dc=com > dn: cn=Directory Administrators, dc=composers,dc=company,dc=com > dn: ou=Groups, dc=composers,dc=company,dc=com > dn: ou=People, dc=composers,dc=company,dc=com > dn: ou=profile,dc=composers,dc=company,dc=com > dn: cn=proxyAgent,ou=profile,dc=composers,dc=company,dc=com > dn: uid=test, ou=People, dc=composers,dc=company,dc=com > > It's not encrypted. I can see the traffic clear text in ethereal. > > Any ideas what the problem is? Has anybody gotten solaris ssl to work with FDS? > > Thank you. > > __________________________________________________ > Do You Yahoo!? > Tired of spam? Yahoo! Mail has the best spam protection around > http://mail.yahoo.com > > -- > Fedora-directory-users mailing list > Fedora-directory-users at redhat.com > https://www.redhat.com/mailman/listinfo/fedora-directory-users > >
