We have two CentOS 8 directory servers running 389ds. They are setup with one as a master and the other as a consumer. Both of these servers use a wildcard GoDaddy SSL cert. The cert has two intermediate certs, and the root cert. Initially, I had both intermediates and the root cert chained in a CA cert file and I used the cockpit web interface to upload the chained file, to both directory servers. When I did this, I was able to connect to both directory servers with Apache Directory Studio. However, replication was not working. openssl s_client -connect showed that each directory server was only presenting the server cert and the first intermediate. Still, openssl reported that everything was "OK". But again, replication wasn't working. During replication, the master was reporting this in the debug logs: (error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed (unable to get issuer certificate)) In an effort to fix this, I uninstalled the chained intermediate/root cert file. I then installed both intermediates, individually, and the the root cert individually. Sure enough, openssl s_client -connect now showed the full chain (server cert -> intermediate 1 -> intermediate 2 -> root CA cert). And replication started working! However, now, when I try to connect to either directory server with Apache Directory Studio, I get the following error: Error while opening connection - ERR_04120_TLS_HANDSHAKE_ERROR The TLS handshake failed, reason: Failed to verify certification path: Algorithm constraints check failed on signature algorithm: SHA1withRSA org.apache.directory.api.ldap.model.exception.LdapTlsHandshakeException: ERR_04120_TLS_HANDSHAKE_ERROR The TLS handshake failed, reason: Failed to verify certification path: Algorithm constraints check failed on signature algorithm: SHA1withRSA Can anybody assist with telling me either what this error means or what is the proper way to be installing the intermediate certs into 389ds in RHEL/CentOS 8, so that both replication and Apache Directory Studio will work? Thanks! Bryan -- Bryan K. Walton 319-337-3877 Linux Systems Administrator Leepfrog Technologies, Inc _______________________________________________ 389-users mailing list -- 389-users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to 389-users-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/389-users@xxxxxxxxxxxxxxxxxxxxxxx
