[Date Prev][Date Next]
Re: Server Certificate Chain
Krasimir Ganchev wrote:
I have already tried adding my Root/Child certificate bundle via
TLSCACertificateFile but it doesn't make any difference and according to
the documentation the directive only specifies certificates for CA's
that slapd will trust.
Yes, it will to exactly, and only that.
The other thing which I have tried was adding the Child /subordinate/ CA
certificate right after the Server certificate in TLFCertificateFile
which also didn't lead to any success.
You have to do that, if you have a chained server certificate.
TLSCACertificatefile requires the rootCA, and subordinate/intermediate
CA certificates as shown below in my example.
You need these to get from the root to the server certificate/private
(TLSCertificateFile/TLSCertificateKeyFile parameters). That will do it
for OpenLDAP. On Windows side, it is totally another game.
Of course I could always add the Child CA certificate to all of the
Windows machine stores and evrything would work just fine, but that's
not the whole idea of paying for trusted certificate.
Krasmir, it is just THAT what you will have to do, if you have a chained
It is not that diffucult:
certmgr.exe -add rootCAcert.der -s -r localMachine root
certmgr.exe -add CA01cert.der -s -r localMachine CA
Then you have both in proper places on Windoze.
I would like to be able to specify the server certificate chain just
like I've done that with SSLCertificateChainFile in apache2 for example.
You can. I already mailed an example file, and example slapd.conf lines.
On 4/18/07, *Kari Mattsson* <firstname.lastname@example.org <mailto:email@example.com>>
Krasimir Ganchev wrote:
> Hello guys,
> I am using a globally recognized certificate with my openldap server
> which is issued by a Child CA trusted by the Root CA of my
> certificate provider. Is there any possible way to include the Child
> CA certificate within the server certificate chain?
I have file (on Linux) /etc/ssl/certs/trivore- ca-bundle.crt, which
# The Trivore 4096 rootCA certificate:
# The Trivore 4096 CA 01 certificate:
..and then in the slapd.conf:
among other lines.
hostname.crt is created by CA01 during certification process.
Just having appropriate/relevant lines in ldap.conf makes the client
work nicely with the server.
Same goes, if you import the rootCA and subordinateCA (CA01) to your
Windows box. There is a separate slot on Windows for root and
intermediate/subordinate CAs. ...but that goes outside the scope of
> The thing is that I have couple of windows based clients using my
> openldap server and I can't make them verify the server certificate.
> The Root CA is included in the trusted Root CAs Windows store, but
> since the Child CA ain't there and doesn't appear in the certificate
> chain the clients could not verify the server certificate and give up
> with an error unless they are being configured to ignore errors.
> That's the reason why I would like to include the Child CA /Signing
> CA/ certificate within the server certificate chain which will allow
> those clients to confirm server's certificate and its signing CA
> certificate against the trusted root CA.
> Is there any possible way to achieve that and is it up to
> Any help is appreciated!
Did it help?
> All my best,
> Krasimir Ganchev
Terveisin/With kind regards/Med hälsningar/Lugupidamisega,