Re: CA and Intermediate Certificates

[Howard Chu <hyc@symas.com>]

Ferenc Wagner wrote:
> Andrew Devenish-Meares <adevenis@une.edu.au> writes:
>
> > We're currently starting to migrate our certificates to AusCERT, as we
> > get a good deal as a University.  As AusCERT is an intermediate CA, so
> > we need to use a chain to get this to work.
> > [...]
> > This means that we need to install the intermediate certificate on
> > clients that connect to our LDAP using SSL or TLS.  Admittedly this
> > isn't vastly different to what we need to do now in supplying our own CA.
>
> You have to put the chain leading to the well-known root CA into your
> server certificate file:

Wrong. The correct usage of CA certificates is already documented in the 
slapd.conf(5) manpage, slapd-config(5) manpage, and the Admin Guide. RTFM.

--
  -- Howard Chu
  CTO, Symas Corp.           http://www.symas.com
  Director, Highland Sun     http://highlandsun.com/hyc/
  Chief Architect, OpenLDAP  http://www.openldap.org/project/