John Mancuso wrote: > Two questions: > > 1. I have generated self-signed ssl/ca certs trying both the > "certutil" method from the redhat doc and also the standard "openssl > x509 req -new" method. After installing the certs and enabling secure > ldaps replication both result in > > slapi_ldap_bind - Error: could not send bind request for id > [cn=replication manager,cn=config] mech [SIMPLE]: error 81 (Can't > contact LDAP server) -8172 (Peer's certificate issuer has been marked > as not trusted by the user.) 11 (Resource temporarily unavailable) > > Is there a known issue with self-signed certs? No, they work fine. Did you add the CA certificate that signed the server certificate as well? You can verify that the certificate is ok on the server with: certutil -V -u V -d /etc/dirsrv/slapd-<YOUR_INSTANCE> You are probably just missing the CA certificate. If you have it in PEM format you can add it via the command-line with: certutil -A -d /etc/dirsrv/slapd-<YOUR_INSTANCE> -n 'Your CA' -t CT,, -a < /path/to/ca.pem The 'Your CA' here is the nickname of the CA certificate. It is how it will appear in the DS console and using certutil -L. Pick something meaningful to you. > 2. If there is an issue with the above, we may end up purchasing a > wildcard cert for replicating across subdomains. I know in the HTML > world some web browsers complain about ssl wildcard certs across > subdomains. Any possible issues with this approach? > > ldaps://supplier_ldap.mycompany.com----> ldaps://consumer_ldap.dev.mycompany.com A wildcard cert will work but its probably overkill to buy one just for this purpose. self-signed certificates will work fine. rob -- 389 users mailing list 389-users@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/389-users
