Re: self signed certificates

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Craig White wrote:

On Thu, 2005-12-08 at 13:00 -0700, Richard Megginson wrote:
Craig White wrote:

Trying to follow instructions at http://www.redhat.com/docs/manuals/dir-server/ag/7.1/ssl.html#1087158

Step #8
Copy the key3.db and cert8.db you created to the default databases
created at Directory Server installation:

where is this 'default databases'?

/opt/fedora-ds/slapd-srv1/ ? # srv1 is name of my server


/opt/fedora-ds/alias/slapd-srv1-key3.db
/opt/fedora-ds/alias/slapd-srv1-cert8.db
----
OK - well that was where I created them...

# ls -l /opt/fedora-ds/alias/
total 520
-rw-------  1 nobody nobody  65536 Dec  8 12:55 admin-serv-srv1-cert8.db
-rw-------  1 nobody nobody  16384 Dec  8 12:55 admin-serv-srv1-key3.db
-rw-------  1 root   root    65536 Dec  8 11:18 cert8.db
-rw-------  1 root   root     2644 Dec  8 11:18 cert.pk12
-rw-------  1 root   root    16384 Dec  8 11:18 key3.db
-rwxr-xr-x  1 root   nobody 194880 Nov 29 15:06 libnssckbi.so
-rw-r--r--  1 root   root       55 Dec  8 11:09 noise.txt
-rw-------  1 root   root        9 Dec  8 11:09 pwdfile.txt
-rw-------  1 nobody nobody  16384 Dec  6 08:46 secmod.db
-rw-------  1 nobody nobody  65536 Dec  8 10:55 slapd-srv1-cert8.db
-rw-------  1 nobody nobody  16384 Dec  8 10:55 slapd-srv1-key3.db

I didn't see them listed anywhere in the console.
Didn't see what listed anywhere in the console?

I think the directions mean "copy your new key3.db over slapd-srv1-key3.db and copy your new cert8.db over slapd-srv1-cert8.db". When you do this, make sure slapd isn't running, and make sure you retain the old ownership and permissions of those files (e.g. nobody:nobody and 0600). Slapd (uid nobody) has to open those files in read-write mode.

I ended up doing this with openssl...
# first using console, I created a server csr (fedora-ds.csr)

then...
openssl req -config /usr/share/ssl/openssl.cnf -new -x509 \
-days 3650 -key ca.key -out ca.cert
openssl genrsa -out ldap.key 1024
openssl req -config /usr/share/ssl/openssl.cnf -new -key ldap.key \
-out ldap.csr
openssl x509 -req -in ldap.csr -out ldap.cert -CA ca.cert \
-CAkey ca.key -CAcreateserial -days 3650
openssl x509 -req -in fedora-ds.csr -out fedora-ds.cert -CA ca.cert \
-CAkey ca.key -CAcreateserial -days 3650cp ca.cert /etc/ssl

Then using the console - in Administration console, Manage Certificates,
CA Certs, I 'installed' the file ca.cert (it seemed happy)

Then in Server Certs, I installed fedora-ds.cert (it seemed happy)

I pretty much repeated the process of creating the signing request and
signing it and generating another server cert and it seems to be happy
too as now, it too lists the certificates both in the server certs and
the CA certs.

So I am pretty good to go right?

Thanks

Craig

--
Fedora-directory-users mailing list
Fedora-directory-users@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-directory-users

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature

--
Fedora-directory-users mailing list
Fedora-directory-users@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-directory-users

[Index of Archives]     [Fedora Directory Users]     [Fedora Directory Devel]     [Fedora Announce]     [Fedora Legacy Announce]     [Kernel]     [Fedora Legacy]     [Share Photos]     [Fedora Desktop]     [PAM]     [Red Hat Watch]     [Red Hat Development]     [Big List of Linux Books]     [Gimp]     [Yosemite News]

  Powered by Linux