John A. Sullivan III a écrit :
On Wed, 2009-06-24 at 18:55 +0200, Jean-Noel Chardron wrote:
Dumbo Q a écrit :
I've managed to get past the the strangely obscure method of
installing an SSL certificate, and from the server side everything
appears to be OK. Actually its a "CACert" certificate, rather then
self signed. Using Jxplorer, I can connect the the DS using SSL,
accept the certificate, and I'm all set.
However, I am having a ton of trouble figuring out how to use an
untrusted ca for my linux user authentication. I changed
/etc/ldap.conf to use ldaps://, and it attemtps to connect as
expected. I think this would work, if I could figure out how to tell
it to accept the certificate. I get the following error message in DS
after running getent passwd.
[24/Jun/2009:12:24:02 -0400] conn=3 op=-1 fd=66 closed - Peer does not
recognize and trust the CA that issued your certificate.
[24/Jun/2009:12:24:02 -0400] conn=4 op=-1 fd=67 closed - Peer does not
recognize and trust the CA that issued your certificate.
Any thoughts?
I think you have to use the directive TLS_CACERT or TLS_CACERT_DIR in
/etc/ldap.conf
man ldap.conf :
TLS_CACERT <filename>
Specifies the file that contains certificates for all of
the Certificate Authorities the client will recognize.
TLS_CACERTDIR <path>
Specifies the path of a directory that contains Certifi‐
cate Authority certificates in separate individual files.
The TLS_CACERT is always used before TLS_CACERTDIR. This
parameter is ignored with GNUtls.
<snip>
I think these may be the wrong variables. If I recall correctly, those
variables are for /etc/openldap/ldap.conf and control openldap (and
openldap related queries). pam uses /etc/ldap.conf. I believe the
variables are set like this:
ssl start_tls
tls_checkpeer yes
tls_cacertfile /usr/share/ca-certificates/CA.pem
or whatever the path happens to be. Again, I'm not an expert - just
sharing what we did that worked - John
that's correct
I apologize, I made a mistake
--
Jean-Noel Chardron
--
389 users mailing list
389-users@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-directory-users
