[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
Re: Storing TLS credentials in the directory
Turbo Fredriksson wrote:
On 9 Apr 2017, at 17:55, Howard Chu <hyc@symas.com> wrote:
2) What if I want a new certificate for that RDN?
Such as the previous one is [about to] expire and it needs to be
refreshed (preferably (?) without destroying/removing the old one).
Currently you would have to delete the old one first.
Ok, thanx. Not that big a’ deal I guess.
I've noted this in the manpage now.
3) Is the CAs _public_ key available as well?
Same reason as point 1.
If the overlay generated it, then it is stored in cACertificate;binary in the suffix entry of the database.
Awesome! Update the man page about this as well then :)
Done.
4) If I already have a CA “on premises” and that have created an
intermediate CA I’d like to use for “autoca”, could this be done?
You can replace cACertificate;binary and cAPrivateKey;binary of the suffix entry to force this.
I see, that’s quite smart! So they’re writable, not just read-only then.
This should probably also be documented.
Is that true for userCertificate and userPrivateKey as well?
Yes. Also noted in the manpage.
If you're running git master, you can look at test066-autoca and see how it works.
--
-- Howard Chu
CTO, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc/
Chief Architect, OpenLDAP http://www.openldap.org/project/