[Date Prev][Date Next]
Re: authentication problem
ok. thanks for the help so far
I could finally configure active directory server to allow anonymous LDAP searches. the CRL Distribution Point given in the certificates issued by this server is :
I did the following search on ubuntu:
ldapsearch -x -h 192.168.81.129 -b "CN=test,CN=testca,CN=CDP,CN=
Public Key Services,CN=Services,CN=Configuration,DC=mohamad,DC=ir" "(objectClass=cRLDistributionPoint)" certificateRevocationListBTW only the second link works but its German and I don't know German. Any References or advice in this context will be appreciated.
it returns:# extended LDIF
# base <CN=test,CN=testca,CN=CDP,CN=
Public Key Services,CN=Services,CN=Configuration,DC=mohamad,DC=ir> with scope subtree
# filter: (objectClass=cRLDistributionPoint)
# requesting: certificateRevocationList
# search result
result: 32 No such object
text: 0000208D: NameErr: DSID-03151EFD, problem 2001 (NO_OBJECT), data 0, bes
t match of:
# numResponses: 1
is the search query wrong or the server is not publishing the CRL? (there is one revoked Certificate in the CRL)
2011/5/16 Michael Ströder <firstname.lastname@example.org>
Mohammad D wrote:See RFC 4523 for object class pkiCA etc.
> I want to start LDAP service for publishing CRLs and Certificates for a
> Certificate Authority.
> I am new to ldap and I have not yet found any good references to guide me how
> to use ldap for these purposes.
You can find examples in LDAP servers of various german trust centers.
There is also
In the example command-line you would have to know the cn and o of an existing
entry to form a correct search base.
$ -b "cn=<common name>,o=<Org Name>"
are just placeholders.
That's why you have to use -x with ldapsearch to send a simple bind request.
> but as I mentioned SASL error was shown.
That's because you are just using the placeholders.
> using -x somehow solved the problem for verisign but doing an empty search
> showed the following error:
> result: 53 server is unwilling to perform
> text: please enter more characters
That's because MS AD does not allow anonymous searches.
> but using -x on active directory server returned the following error:
> result: 1 operation error
> text: 00000000 LdapErr: DSID-0X090627, comment In order to perform this
> operation a successful bind must be completed on connection., data 0