[Date Prev][Date Next]
Re: SSL handshake failure
On Mon, 18 Feb 2008, Nathan Huesken wrote:
I am trying to enable TLS on my ldap server. I executed:
openssl req -config /etc/ssl/openssl.cnf -new -x509 -nodes -out /etc/ssl/ldap.pem -keyout /etc/openldap/ldap-key.pem -days 999999
That creates a self-signed certificate. If you really do have a need to
use and issue client certificates, then you'll almost certainly want to
issue them from a common CA so that they can be validated more easily.
Whether a single CA or multiple levels of CAs is the best match for your
needs is a question beyond the scope of this list; you should check the
OpenSSL documentation and mailing lists for help on that.
to my slapd.conf.
You should first get TLS working without requiring client certs. Once you
have that working correctly and securely, then you can work through the
details of getting client certs working on that stable foundation.
To my ldap.conf, I added:
To quote the ldap.conf(5) manpage: "This is a user-only option."
You want a setup where client have to present certs, but they don't need
to validate the server's cert? That seems counter-productive. I would
expect a TLS_CACERT option here instead. Since the server's cert is
self-signed, it is its own CA:
...at least until you use separate certs for the CA and server.