Dumbo Q a ?crit : > I've managed to get past the the strangely obscure method of > installing an SSL certificate, and from the server side everything > appears to be OK. Actually its a "CACert" certificate, rather then > self signed. Using Jxplorer, I can connect the the DS using SSL, > accept the certificate, and I'm all set. > > However, I am having a ton of trouble figuring out how to use an > untrusted ca for my linux user authentication. I changed > /etc/ldap.conf to use ldaps://, and it attemtps to connect as > expected. I think this would work, if I could figure out how to tell > it to accept the certificate. I get the following error message in DS > after running getent passwd. > > [24/Jun/2009:12:24:02 -0400] conn=3 op=-1 fd=66 closed - Peer does not > recognize and trust the CA that issued your certificate. > [24/Jun/2009:12:24:02 -0400] conn=4 op=-1 fd=67 closed - Peer does not > recognize and trust the CA that issued your certificate. > > > Any thoughts? > I think you have to use the directive TLS_CACERT or TLS_CACERT_DIR in /etc/ldap.conf man ldap.conf : TLS_CACERT <filename> Specifies the file that contains certificates for all of the Certificate Authorities the client will recognize. TLS_CACERTDIR <path> Specifies the path of a directory that contains Certifi? cate Authority certificates in separate individual files. The TLS_CACERT is always used before TLS_CACERTDIR. This parameter is ignored with GNUtls. > ------------------------------------------------------------------------ > > -- > 389 users mailing list > 389-users at redhat.com > https://www.redhat.com/mailman/listinfo/fedora-directory-users >
