[Date Prev][Date Next]
Re: OpenLDAP and wildcard SSL certs
On Thursday 14 April 2005 10:32, Brent J. Nordquist wrote:
> I have been unable to find a way to get wildcard SSL certs to work
> with OpenLDAP 2.1.32 and OpenSSL 0.9.6b (plus security patches). I have
> created my own CA, and used it to sign a cert. with cn=ldap.example.com
> and that works fine. (The proper TLS_CACERT setting is in ldap.conf for
> ldapsearch etc.)
> If I do the same to sign a cert. with with cn=*.example.com it works fine
> for everything I've tested (Apache, Sendmail, etc.), but not OpenLDAP.
> This page:
> says that you need to use subjectAltName instead of CN. So I added the
> appropriate lines to openssl.cnf and created a cert. with cn=*.example.com
> plus subjectAltName=DNS:*.example.com, and OpenLDAP fails that with:
I'm using the subjectAltName successfully though I am not using the wildcards.
I'm using DNS:<hostname>, IP:<ip address>
Did you verify the subjectAltName was actually added on your signed
certificate? openssl x509 -in <cert> -text
As far as I know, CN should be the fully qualified domain name. subjectAltName
should have the wildcard.
Mike Wisener, GCIA
Senior Information Security Analyst
LURHQ -- http://www.lurhq.com