Hi Rubin, You can achieve this very easily. Just setup a CA and have your servers' certificates signed by your CA. Then copy the CA certificate to your clients (/etc/openldap/cacerts) and you are done. Andreas Rubin wrote: > Hi all! > > I'm trying to figure out how to handle high availability in > combination with ssl. I have ssl working for both clients and > server to server connections. The problem is that i would like to > give a client only one ip/fqdn for the ldap server, like > ldap.example.com and manage failover to a second ldap multimaster > machine by bringing up that ip or switching the dns entry of the > fqdn to the at that moment designated as active ldap server. > > The problem lies in the fact that the certificate on the client > has a dn that has to match the hostname to be contacted (ie. > ldap.example.com) but i don't want to have identical certificates > on the ldap servers (if the dn does not match the hostname to be contacted, > connection will fail, verified with openssl). > > So how can you have a client contact ldap.example.com with ssl enabled > while having the ability to switch ldap.example.com between two machines > without douing something evilish like having identical certificates for > both ldap servers? How are others handling these things? > > The reason i want to do failover this way has to do with wanting > to avoid the posibility of possible conflicts when having the > ability to write to 2 masters at the same time. > > Thanks for any pointers and/or eyeopeners! > > Grtz, > > Rubin. > > -- > Fedora-directory-users mailing list > Fedora-directory-users at redhat.com > https://www.redhat.com/mailman/listinfo/fedora-directory-users > > -------------- next part -------------- A non-text attachment was scrubbed... Name: kekkou.a.vcf Type: text/x-vcard Size: 302 bytes Desc: not available Url : http://lists.fedoraproject.org/pipermail/389-users/attachments/20070723/a86022d3/attachment.vcf -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 3655 bytes Desc: S/MIME Cryptographic Signature Url : http://lists.fedoraproject.org/pipermail/389-users/attachments/20070723/a86022d3/attachment.bin
