[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: SSL certificates, kerberos keytabs, and load balancing


Quanah Gibson-Mount <quanah@stanford.edu> writes:

> --On Friday, April 09, 2004 3:26 PM +0200 denis.havlik@t-mobile.at wrote:
>> Hi, folks
>> I'm trying to figure out what happens when one starts doing the load
>> balancing with LDAP servers. Don't really need it today, but it seams to
>> be a good day for such questions. :-)
>> So, we have N machines called ldapX.mydomain that all answer to requests
>> sent to "ldap.mydomain". As far as "certificates"/"keys" go, there are
>> two things that can go wrong:
>> 2) ssl certificate
>> OK, which name is used here? ldap.mydomain on all the servers, or
>> different certificate (issued for ldapX.mydomain) for each of the
>> servers?
>> Btw, could someone point me to a piece of documentation explaining
>> step-by-step how to set up load balancing 4 LDAP?
> Good question about what it will want cert wise.  I do *not* suggest
> software load balancing and SSL.  For that to work, you need a * cert.
> We currently use software load balancing, and are unable to use TLS
> because the call to "ldap.stanford.edu" will return the server's real
> cert (ldapX.stanford.edu).  If I use a different cert for the server
> (ldap.stanford.edu), I get a host name mismatch.  So you'll have to
> use hardware load balancing.  I plan to test that with Stanford's
> directory servers in the future, but that is a future project. ;)

To solve the host mismatch problem in certificates you may addionally
use the attribute subjectAltName, i.e. 
subjectAltName=commonName: ldap.example.com


Dieter Kluenter  | Systemberatung
Tel:040.64861967 | Fax: 040.64891521
mailto: dkluenter(at)dkluenter.de