Jeff Gamsby Center for X-Ray Optics Lawrence Berkeley National Laboratory (510) 486-7783 Richard Megginson wrote: > Jeff Gamsby wrote: >> >> Jeff Gamsby >> Center for X-Ray Optics >> Lawrence Berkeley National Laboratory >> (510) 486-7783 >> >> >> >> Richard Megginson wrote: >>> Jeff Gamsby wrote: >>>> I am trying to get FDS 1.0.2 working in SSL mode. I am using a >>>> OpenSSL CA, I have installed the Server Cert and the CA Cert, can >>>> start FDS in SSL mode, but when I run >>>> ldapsearch -x -ZZ I get TLS trace: SSL3 alert write:fatal:unknown CA. >>> Did you follow this - http://directory.fedora.redhat.com/wiki/Howto:SSL >> I did, but that didn't work for me. The only thing that I did this >> time was generate a request from the "Manage Certificates", sign the >> request using my OpenSSL CA, and install the Server and CA Certs. >> Then I turned on SSL in the Admin console, and restarted the server. >> >> When I followed the instructions from the link, I couldn't even get >> FDS to start in SSL mode. > One problem may be that ldapsearch is trying to verify the hostname in > your server cert, which is the value of the cn attribute in the > leftmost RDN in your server cert's subject DN. What is the subject DN > of your server cert? You can use certutil -L -n Server-Cert as > specified in the Howto:SSL to print your cert. Running cd /opt/fedora-ds/alias ; ../shared/bin/certutil -L -d . -n "server-cert" returns: certutil-bin: Could not find: server-cert : security library: bad database. I can see the Subject DN in "Manage Certificates" --> Server Certs --> Detail It's the FQDN of the FDS server ( and the OpenSSL CA ) >>>> >>>> In /etc/ldap.conf, I have put in >>>> TLS_CACERT /path/to/cert >>> Is this the same /path/to/cacert.pem as below? >> Yes >>>> TLSREQCERT allow >>>> ssl on >>>> ssl start_tls >>>> >>>> If I run >>>> openssl s_client -connect localhost:636 -showcerts -state -CAfile >>>> /path/to/cacert.pem >>>> >>>> It looks OK >>>> >>>> Please help >>>> >>>> Thanks >>>> >>> ------------------------------------------------------------------------ >>> >>> >>> -- >>> Fedora-directory-users mailing list >>> Fedora-directory-users at redhat.com >>> https://www.redhat.com/mailman/listinfo/fedora-directory-users >>> >> >> -- >> Fedora-directory-users mailing list >> Fedora-directory-users at redhat.com >> https://www.redhat.com/mailman/listinfo/fedora-directory-users > ------------------------------------------------------------------------ > > -- > Fedora-directory-users mailing list > Fedora-directory-users at redhat.com > https://www.redhat.com/mailman/listinfo/fedora-directory-users >
