Jean-Noel Chardron a ?crit : > Dumbo Q a ?crit : >> I've managed to get past the the strangely obscure method of >> installing an SSL certificate, and from the server side everything >> appears to be OK. Actually its a "CACert" certificate, rather then >> self signed. Using Jxplorer, I can connect the the DS using SSL, >> accept the certificate, and I'm all set. >> >> However, I am having a ton of trouble figuring out how to use an >> untrusted ca for my linux user authentication. I changed >> /etc/ldap.conf to use ldaps://, and it attemtps to connect as >> expected. I think this would work, if I could figure out how to tell >> it to accept the certificate. I get the following error message in DS >> after running getent passwd. >> >> [24/Jun/2009:12:24:02 -0400] conn=3 op=-1 fd=66 closed - Peer does >> not recognize and trust the CA that issued your certificate. >> [24/Jun/2009:12:24:02 -0400] conn=4 op=-1 fd=67 closed - Peer does >> not recognize and trust the CA that issued your certificate. >> >> >> Any thoughts? >> > I think you have to use the directive TLS_CACERT or TLS_CACERT_DIR in > /etc/ldap.conf > man ldap.conf : > TLS_CACERT <filename> > Specifies the file that contains certificates for all of > the Certificate Authorities the client will recognize. > > TLS_CACERTDIR <path> > Specifies the path of a directory that contains Certifi? > cate Authority certificates in separate individual files. > The TLS_CACERT is always used before TLS_CACERTDIR. This > parameter is ignored with GNUtls. > or may be, to test the connection, you can skip the check of the certificate (as i discover in the man) with the option : TLS_REQCERT allow >> ------------------------------------------------------------------------ >> >> -- >> 389 users mailing list >> 389-users at redhat.com >> https://www.redhat.com/mailman/listinfo/fedora-directory-users >> > > -- > 389 users mailing list > 389-users at redhat.com > https://www.redhat.com/mailman/listinfo/fedora-directory-users
