[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
Antw: RE: N-Way multimaster Replication with TLS and multiple server certificates
>>> Chris Jacobs <Chris.Jacobs@apollo.edu> schrieb am 09.12.2014 um 23:18 in
Nachricht
<6C447584419BFE4E83D46E88F8131486D2CCB794E0@EXCH07-05.apollogrp.edu>:
> I use a cert with the VIP used by clients, and the hostnames used between
the
> servers all setup in the subjectaltname of the certificate.
But this "solution" does not scale well when adding or removing servers...
>
> From: openldap-technical [mailto:openldap-technical-bounces@openldap.org] On
> Behalf Of coma
> Sent: Tuesday, December 09, 2014 1:13 PM
> To: Michael Ströder
> Cc: openldap-technical@openldap.org
> Subject: Re: N-Way multimaster Replication with TLS and multiple server
> certificates
>
> Hello,
> ok thank you. Just wanted to know if there was an alternative, now I know
> there are none! I will do as Quanah and you said.
> Thanks again for for your responsiveness!
>
> 2014-12-09 20:55 GMT+01:00 Michael Ströder
> <michael@stroeder.com<mailto:michael@stroeder.com>>:
> coma wrote:
>> My problem is that cn=config is replicated on all servers, including
>> TLSCertificateFile and TLSCertificateKeyFile... therefore the replication
>> obviously not working (the certificate and key path of the first server
are
>> replicated on the second server).
>>
>> I know there is some solutions to workaround this "issue", like:
>> - Don't replicate cn=config
>> - Use the same certificate and key for all servers
>> - Use the same certificate and key path in cn=config (ex:
>> /etc/openldap/cert/common_cert_name.pem and
>> /etc/openldap/cert/common_cert_name.key) and then make symlinks to the
>> correct files on the local server
>
> ..or directly place the correct files to the same certificate and key path.
>
> Yes, that's what
> ansible/puppet/chef/name-your-favourite-config-management-tool
> is for.
>
> Ciao, Michael.
>
>
> ________________________________
> This message is private and confidential. If you have received it in error,
> please notify the sender and remove it from your system.