SSL SAN Cert not trusted

[Justin Edmands <shockwavecs@xxxxxxxxx>]

I am trying to create a SAN cert in order to cover both of my Master LDAPS servers.

I was hoping to have the following:

hqdirsrv1\

               > hqdirsrv

hqdirsrv2/

This will allow some of the older code to reference a single LDAP/S server and not completely rely one instance.

 - Creating a normal SSL cert works perfectly fine from my self signed CA. Fully functional server

 - Creating a SAN cert, exporting it, and importing it to the two Masters works fine.

 - In the Admin GUI, Manage Certificates shows the proper SAN certificate and proper CA associated with this SAN cert.
 - Starting (or restarting after saving the encryption stuff) the directory server succeeds, but with the following error:

[root@hqdirsrv1 slapd-hqdirsrv1]# service dirsrv start
Starting dirsrv:
    hqdirsrv1...[25/Jun/2013:11:55:45 -0400] - SSL alert: CERT_VerifyCertificateNow: verify certificate failed for cert Server-Cert-hqdirsrv-SAN of family cn=RSA,cn=encryption,cn=config (Netscape Portable Runtime error -8172 - Peer's certificate issuer has been marked as not trusted by the user.)
                                                           [  OK  ]

Am I missing a cert or setting for a cert anywhere?

Because this is in dev right now, I trashed my old instance and started fresh without any ldif imports, etc...same results.

--
389 users mailing list
389-users@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/389-users