Jeff Gamsby wrote:
Jeff Gamsby Center for X-Ray Optics Lawrence Berkeley National Laboratory (510) 486-7783 Richard Megginson wrote:Jeff Gamsby wrote:But does the file /etc/openldap/cacerts/cacert.asc exist? If not, you need to copy that file in there. I guess the docs are not explicit enough - if you use TLS_CACERTDIR, you must have the file <hash>.0 in the cacerts directory. If you use TLS_CACERT, you must have the file /etc/openldap/cacerts/cacert.asc.Jeff Gamsby Center for X-Ray Optics Lawrence Berkeley National Laboratory (510) 486-7783 Richard Megginson wrote:Jeff Gamsby wrote:Jeff Gamsby Center for X-Ray Optics Lawrence Berkeley National Laboratory (510) 486-7783 Richard Megginson wrote:Jeff Gamsby wrote:I blew away the server and installed a new one, then I used the setupssl.sh script to setup SSL. The script completed successfully, and the server is listening on port 636, but I'm back to a familiar error:No, no hostname validation is done on the CA cert, only on the LDAP server cert.ldapsearch -x -ZZ -d -1 TLS trace: SSL_connect:SSLv3 read server hello ATLS certificate verification: depth: 1, err: 19, subject: /CN=CAcert, issuer: /CN=CAcert TLS certificate verification: Error, self signed certificate in certificate chaintls_write: want=7, written=70000: 15 03 01 00 02 02 30 ......0 TLS trace: SSL3 alert write:fatal:unknown CATLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect. ldap_perror ldap_start_tls: Connect error (-11)additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failedShouldn't CN=CAcert be cn=fqdn?Did you configure openldap to use the new CA cert? http://directory.fedora.redhat.com/wiki/Howto:SSL#Configure_LDAP_clientsYes. This is what the access log says[02/Jun/2006:14:58:41 -0700] conn=2 op=462 RESULT err=0 tag=101 nentries=0 etime=0 [02/Jun/2006:14:58:47 -0700] conn=124 fd=68 slot=68 connection from 127.0.0.1 to 127.0.0.1 [02/Jun/2006:14:58:47 -0700] conn=124 op=0 EXT oid="1.3.6.1.4.1.1466.20037" name="startTLS" [02/Jun/2006:14:58:47 -0700] conn=124 op=0 RESULT err=0 tag=120 nentries=0 etime=0 [02/Jun/2006:14:58:47 -0700] conn=124 op=-1 fd=68 closed - Peer does not recognize and trust the CA that issued your certificate.This means that the CA cert that /etc/openldap/ldap.conf is using is not the cert of the CA that issued the Fedora DS server cert.OK. I had the old cert in there. I followed the instructions and did acp cacert.asc /etc/openldap/cacerts/`openssl x509 -noout -hash -in cacert.asc`.0and set TLS_CACERT to /etc/openldap/cacerts/cacert.asc. I still get the same errorIt does exist, and I'm using TLS_CACERT /etc/openldap/cacerts/cacert.asc Same error.[02/Jun/2006:15:34:53 -0700] conn=30 fd=68 slot=68 connection from 127.0.0.1 to 127.0.0.1 [02/Jun/2006:15:34:53 -0700] conn=30 op=0 EXT oid="1.3.6.1.4.1.1466.20037" name="startTLS" [02/Jun/2006:15:34:53 -0700] conn=30 op=0 RESULT err=0 tag=120 nentries=0 etime=0 [02/Jun/2006:15:34:53 -0700] conn=30 op=-1 fd=68 closed - Peer does not recognize and trust the CA that issued your certificate.I also put the same info in /etc/ldap.conf
That file is only used by pam_ldap and nss_ldap, so it shouldn't matter.
Also, here are the certs ../shared/bin/certutil -L -P slapd-server- -d . CA certificate CTu,u,u server-cert u,u,u Server-Cert u,u,u Does that look right?
Try this:../shared/bin/certutil -L -P slapd-server- -d . -n "CA certificate" -a > mycacert.asc
diff mycacert.asc /etc/openldap/cacerts/cacert.ascIf they are the same, then CA certificate is not the cert of the CA that issued Server-Cert.
[02/Jun/2006:15:24:47 -0700] conn=10 fd=67 slot=67 connection from 127.0.0.1 to 127.0.0.1 [02/Jun/2006:15:24:47 -0700] conn=10 op=0 EXT oid="1.3.6.1.4.1.1466.20037" name="startTLS" [02/Jun/2006:15:24:47 -0700] conn=10 op=0 RESULT err=0 tag=120 nentries=0 etime=0 [02/Jun/2006:15:24:47 -0700] conn=10 op=-1 fd=67 closed - Peer does not recognize and trust the CA that issued your certificate.------------------------------------------------------------------------This is all that the errors log saysHow about the access log?------------------------------------------------------------------------[02/Jun/2006:14:21:01 -0700] - No symmetric key found for cipher AES in backend userRoot, attempting to create one... [02/Jun/2006:14:21:01 -0700] - Key for cipher AES successfully generated and stored [02/Jun/2006:14:21:01 -0700] - No symmetric key found for cipher 3DES in backend userRoot, attempting to create one... [02/Jun/2006:14:21:01 -0700] - Key for cipher 3DES successfully generated and stored [02/Jun/2006:14:21:01 -0700] - No symmetric key found for cipher AES in backend NetscapeRoot, attempting to create one... [02/Jun/2006:14:21:01 -0700] - Key for cipher AES successfully generated and stored [02/Jun/2006:14:21:01 -0700] - No symmetric key found for cipher 3DES in backend NetscapeRoot, attempting to create one... [02/Jun/2006:14:21:01 -0700] - Key for cipher 3DES successfully generated and stored [02/Jun/2006:14:21:01 -0700] - slapd started. Listening on All Interfaces port 389 for LDAP requests [02/Jun/2006:14:21:01 -0700] - Listening on All Interfaces port 636 for LDAPS requestsThanks for your help Jeff Gamsby Center for X-Ray Optics Lawrence Berkeley National Laboratory (510) 486-7783 Richard Megginson wrote:Jeff Gamsby wrote:What OS and version are you running? RHEL3 /etc/openldap/ldap.conf does not like the TLS_CACERTDIR directive - you must use the TLS_CACERT directive with the full path and filename of the cacert.pem file (e.g. /etc/openldap/cacerts/cacert.pem). What does it say in the fedora ds access and error log for this request?OK, now I have a different error.I ran ../shared/bin/certutil -A -n cert-name -t "C,C,C" -i /etc/certs/ca-cert.pem -P slapd-server- -d .and ln -s ca-cert.pem `openssl x509 -noout -hash -in ca-cert.pem`.0 Now, I get this error: TLS: can't connect. ldap_perror ldap_start_tls: Connect error (-11)additional info: Start TLS request accepted.Server willing to negotiate SSL.For a successful startTLS request with ldapsearch, you should see something like the following in your fedora ds access log: [02/Jun/2006:15:31:48 -0600] conn=11 fd=64 slot=64 connection from 127.0.0.1 to 127.0.0.1 [02/Jun/2006:15:31:48 -0600] conn=11 op=0 EXT oid="1.3.6.1.4.1.1466.20037" name="startTLS" [02/Jun/2006:15:31:48 -0600] conn=11 op=0 RESULT err=0 tag=120 nentries=0 etime=0[02/Jun/2006:15:31:48 -0600] conn=11 SSL 256-bit AES[02/Jun/2006:15:31:48 -0600] conn=11 op=1 BIND dn="" method=128 version=3 [02/Jun/2006:15:31:48 -0600] conn=11 op=1 RESULT err=0 tag=97 nentries=0 etime=0 dn="" [02/Jun/2006:15:31:48 -0600] conn=11 op=2 SRCH base="dc=example,dc=com" scope=0 filter="(objectClass=*)" attrs=ALL [02/Jun/2006:15:31:48 -0600] conn=11 op=2 RESULT err=0 tag=101 nentries=1 etime=0[02/Jun/2006:15:31:48 -0600] conn=11 op=3 UNBIND [02/Jun/2006:15:31:48 -0600] conn=11 op=3 fd=64 closed - U1------------------------------------------------------------------------Jeff Gamsby Center for X-Ray Optics Lawrence Berkeley National Laboratory (510) 486-7783 Richard Megginson wrote:Jeff Gamsby wrote:Hmm - try ldapsearch with the -v (or -d?) option to get some debugging info.Jeff Gamsby Center for X-Ray Optics Lawrence Berkeley National Laboratory (510) 486-7783 Richard Megginson wrote:Jeff Gamsby wrote:One problem may be that ldapsearch is trying to verify the hostname in your server cert, which is the value of the cn attribute in the leftmost RDN in your server cert's subject DN. What is the subject DN of your server cert? You can use certutil -L -n Server-Cert as specified in the Howto:SSL to print your cert.Jeff Gamsby Center for X-Ray Optics Lawrence Berkeley National Laboratory (510) 486-7783 Richard Megginson wrote:I did, but that didn't work for me. The only thing that I did this time was generate a request from the "Manage Certificates", sign the request using my OpenSSL CA, and install the Server and CA Certs. Then I turned on SSL in the Admin console, and restarted the server.Jeff Gamsby wrote:I am trying to get FDS 1.0.2 working in SSL mode. I am using a OpenSSL CA, I have installed the Server Cert and the CA Cert, can start FDS in SSL mode, but when I run ldapsearch -x -ZZ I get TLS trace: SSL3 alert write:fatal:unknown CA.Did you follow this - http://directory.fedora.redhat.com/wiki/Howto:SSLWhen I followed the instructions from the link, I couldn't even get FDS to start in SSL mode.Sorry. I missed the -P option.running ../shared/bin/certutil -L -d . -P slapd-server- -n "server-cert" returns the Subject *CN* as FQDN of FDS and OpenSSL CA host (ran on same machine)------------------------------------------------------------------------------------------------------------------------------------------------In /etc/ldap.conf, I have put in TLS_CACERT /path/to/certIs this the same /path/to/cacert.pem as below?Yes------------------------------------------------------------------------TLSREQCERT allow ssl on ssl start_tls If I runopenssl s_client -connect localhost:636 -showcerts -state -CAfile /path/to/cacert.pemIt looks OK Please help Thanks-- Fedora-directory-users mailing list Fedora-directory-users@xxxxxxxxxxhttps://www.redhat.com/mailman/listinfo/fedora-directory-users-- Fedora-directory-users mailing list Fedora-directory-users@xxxxxxxxxxhttps://www.redhat.com/mailman/listinfo/fedora-directory-users-- Fedora-directory-users mailing list Fedora-directory-users@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-directory-users-- Fedora-directory-users mailing list Fedora-directory-users@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-directory-users-- Fedora-directory-users mailing list Fedora-directory-users@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-directory-users-- Fedora-directory-users mailing list Fedora-directory-users@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-directory-users-- Fedora-directory-users mailing list Fedora-directory-users@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-directory-users-- Fedora-directory-users mailing list Fedora-directory-users@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-directory-users-- Fedora-directory-users mailing list Fedora-directory-users@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-directory-users-- Fedora-directory-users mailing list Fedora-directory-users@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-directory-users-- Fedora-directory-users mailing list Fedora-directory-users@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-directory-users-- Fedora-directory-users mailing list Fedora-directory-users@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-directory-users------------------------------------------------------------------------ -- Fedora-directory-users mailing list Fedora-directory-users@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-directory-users-- Fedora-directory-users mailing list Fedora-directory-users@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-directory-users
Attachment:
smime.p7s
Description: S/MIME Cryptographic Signature
-- Fedora-directory-users mailing list Fedora-directory-users@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-directory-users
