[Date Prev][Date Next]
Re: OpenLDAP and wildcard SSL certs
On Thursday 14 April 2005 11:59, you wrote:
> Thanks for the feedback:
> On Thu, Apr 14, 2005 at 11:33:16AM -0400, Mike Wisener wrote:
> > Did you verify the subjectAltName was actually added on your signed
> > certificate? openssl x509 -in <cert> -text
> Yes, I did.
> > As far as I know, CN should be the fully qualified domain
> > name. subjectAltName should have the wildcard.
> But that defeats the whole purpose. Then you'd have to have one cert.
> for each FQDN and then what's the point of using a wildcard at all?
> Or am I misunderstanding what you're saying?
If the hostname you use in ldap://<hostname> matches the CN -- you are good.
If not, and subjectAltName is present, then <hostname> should be compared to
values in subjectAltName.
This is my understanding and as far as I can tell, it works in practice. If
someone knows there is another way this works, hopefully they will jump in.
Mike Wisener, GCIA
Senior Information Security Analyst
LURHQ -- http://www.lurhq.com