[Fedora-directory-users] Win2003 AD SSL certs

Jeff Gamsby JFGamsby at lbl.gov
Tue Jul 18 15:02:16 UTC 2006


Thanks,

 I tried that, it doesn't seem to matter. When I had it running on a 
Win2k server, it worked with the "-P ." 

I'm wondering if there is anything that has to be done differently when 
using Win2003 vs. Win2k servers?

I guess it could be a DNS problem. I'm looking into that now.

Any suggestions are welcome.


Richard Megginson wrote:
> Jeff Gamsby wrote:
>>
>> Can someone please tell me if I have this right?
>>
>> 1) Create certs for FDS server.
>> 2) export servercerts on FDS.
>> 3) install Active Directory and certificate services ( Enterprise 
>> Root CA )
>> 4) Setup Active Directory for SSL ( tested with ldp.exe )
>> 5) Export AD cert, import into FDS
>> 6) Install PassSync, import servercerts from FDS
>> 7) Test ldapsearch over SSL to AD.
>>
>> I have just upgraded to Windows server 2003 R2 and I can't get SSL 
>> from FDS to AD working again.
>>
>> I get this error.
>>
>> ../shared/bin/ldapsearch -Z -P . -h ad-server -p 636 -D 
>> "cn=administrator,cn=users,dc=xxx,dc=xxx,dc=xxx" -w - -s sub -b 
>> "cn=users,dc=xxx,dc=xxx,dc=xxx" "cn=*" -v
> Assuming you're not using cert8.db and key3.db as your key/cert db 
> names, the argument to -P should be the full path and filename of the 
> key/cert database e.g. -P /opt/fedora-ds/alias/slapd-instance-cert8.db.
>
>>
>> ldap_simple_bind: Can't contact LDAP server
>>        SSL error -8179 (Peer's Certificate issuer is not recognized.)
>>
>> Thanks in advance.
>>
>> J.G.
>>
>>
>>
>>
>> -- 
>> Fedora-directory-users mailing list
>> Fedora-directory-users at redhat.com
>> https://www.redhat.com/mailman/listinfo/fedora-directory-users
> ------------------------------------------------------------------------
>
> --
> Fedora-directory-users mailing list
> Fedora-directory-users at redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>   




More information about the Fedora-directory-users mailing list