Re: [389-users] ssl replication

[Rich Megginson <rmeggins@xxxxxxxxxx>]

On 05/19/2011 08:56 AM, solarflow99 wrote:

I'm trying to configure replication over SSL using StartTLS, I don't see any example of how to export/import self signed certs into the slave.  Here's what I did:
created a CA cert and server cert on the master, everything is fine.  exported the CA cert and copied it to the slave:


[root@ldapslave]# certutil -A -d . -n "CA certificate" -t "CT,," -a -i cacert.asc

[root@ldapslave]# certutil -d . -L

Certificate Nickname                                         Trust Attributes
                                                             SSL,S/MIME,JAR/XPI

CA certificate                                               CT,,



What is next?  I tried everything I could think of..

The SSL roles are _opposite_ the master/slave roles.  The master pushes changes to the slave.  So in this instance, the _slave_ is the SSL _server_, and the _master_ is the SSL _client_.
In order to be an SSL server, the slave must have a server cert/key and CA cert.
In order to be an SSL client, the master must have just the CA cert.

--
389 users mailing list
389-users@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/389-users

--
389 users mailing list
389-users@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/389-users