On Wed, 2009-06-24 at 18:55 +0200, Jean-Noel Chardron wrote: > Dumbo Q a écrit : > > I've managed to get past the the strangely obscure method of > > installing an SSL certificate, and from the server side everything > > appears to be OK. Actually its a "CACert" certificate, rather then > > self signed. Using Jxplorer, I can connect the the DS using SSL, > > accept the certificate, and I'm all set. > > > > However, I am having a ton of trouble figuring out how to use an > > untrusted ca for my linux user authentication. I changed > > /etc/ldap.conf to use ldaps://, and it attemtps to connect as > > expected. I think this would work, if I could figure out how to tell > > it to accept the certificate. I get the following error message in DS > > after running getent passwd. > > > > [24/Jun/2009:12:24:02 -0400] conn=3 op=-1 fd=66 closed - Peer does not > > recognize and trust the CA that issued your certificate. > > [24/Jun/2009:12:24:02 -0400] conn=4 op=-1 fd=67 closed - Peer does not > > recognize and trust the CA that issued your certificate. > > > > > > Any thoughts? > > > I think you have to use the directive TLS_CACERT or TLS_CACERT_DIR in > /etc/ldap.conf > man ldap.conf : > TLS_CACERT <filename> > Specifies the file that contains certificates for all of > the Certificate Authorities the client will recognize. > > TLS_CACERTDIR <path> > Specifies the path of a directory that contains Certifi‐ > cate Authority certificates in separate individual files. > The TLS_CACERT is always used before TLS_CACERTDIR. This > parameter is ignored with GNUtls. > > ><snip> I think these may be the wrong variables. If I recall correctly, those variables are for /etc/openldap/ldap.conf and control openldap (and openldap related queries). pam uses /etc/ldap.conf. I believe the variables are set like this: ssl start_tls tls_checkpeer yes tls_cacertfile /usr/share/ca-certificates/CA.pem or whatever the path happens to be. Again, I'm not an expert - just sharing what we did that worked - John -- John A. Sullivan III Open Source Development Corporation +1 207-985-7880 jsullivan@xxxxxxxxxxxxxxxxxxx http://www.spiritualoutreach.com Making Christianity intelligible to secular society -- 389 users mailing list 389-users@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-directory-users
