On Sat, 2009-01-17 at 19:59 -0500, John A. Sullivan III wrote: > Hello, all. We are working on implementing SSL on our directory server. > Our test environment is using Centos using console framework 1.1.1 and > ds centos-ds-8.0.0-1.4.el5.centos.4. When we attempt to login to > centos-idm-console, we receive an error that the certificate this server > presents is either untrusted or unknown. When we view the cert, the > note under details says "Untrusted issuer". However, if we look in > Manage Certificates for the Administration Server (I assume the console > is logging into the Administration Server but the same is true for the > Directory Server), we see the CA cert as trusted and see the certificate > chain. Everything looks correct. Why is the console not trusting the > CA cert? Is it looking for it someplace else? If so, where? > > More details: > I'm assuming the problem is the CA cert. The admin server cert details > are: > cn=ldap01admin.ssiservices.biz > There are DNS entries in subjAltName of: > ldap01.ssiservices.biz > ldap01 > ldap01admin > and there is an IP address entry. > > I get the same problem connecting to > https://ldap01admin.ssiservices.biz:9830 as > https://ldap01.ssiservices.biz:9830 > On a lark, I took a look in my home directory and, sure enough, found a .centos-idm-console directory. I entered it and issue the following command to import the CA cert into the individual user's database: certutil -A -d . -n "CA certificate" -t "CT,," -a -i /etc/dirsrv/admin-serv/SSICA.pem It all works now. Perhaps I overlooked it but I did not see that step in the documentation. I've also noticed that the manage certificate dialogs reverse the OU and O fields on the details page. Finally, it appears idm-console can use the entries in the subjAltName, i.e., I can login using both ldap01 and ldap01admin for the host but it does not like the IP field, i.e., I cannot login to https://10.1.1.1:9830 without generating a cert warning - John -- John A. Sullivan III Open Source Development Corporation +1 207-985-7880 jsullivan at opensourcedevel.com http://www.spiritualoutreach.com Making Christianity intelligible to secular society
