[Fedora-directory-users] TLS trace: SSL3 alert write:fatal:unknown CA

[Jeff Gamsby]

Jeff Gamsby
Center for X-Ray Optics
Lawrence Berkeley National Laboratory
(510) 486-7783



Richard Megginson wrote:
> Jeff Gamsby wrote:
>>
>> Jeff Gamsby
>> Center for X-Ray Optics
>> Lawrence Berkeley National Laboratory
>> (510) 486-7783
>>
>>
>>
>> Richard Megginson wrote:
>>> Jeff Gamsby wrote:
>>>> I am trying to get FDS 1.0.2 working in SSL mode. I am using a 
>>>> OpenSSL CA, I have installed the Server Cert and the CA Cert, can 
>>>> start FDS in SSL mode, but when I run
>>>> ldapsearch -x -ZZ  I get TLS trace: SSL3 alert write:fatal:unknown CA.
>>> Did you follow this - http://directory.fedora.redhat.com/wiki/Howto:SSL
>> I did, but that didn't work for me. The only thing that I did this 
>> time was generate a request from the "Manage Certificates", sign the 
>> request using my OpenSSL CA, and install the Server and CA Certs. 
>> Then I turned on SSL in the Admin console, and restarted the server.
>>
>> When I followed the instructions from the link, I couldn't even get 
>> FDS to start in SSL mode.
> One problem may be that ldapsearch is trying to verify the hostname in 
> your server cert, which is the value of the cn attribute in the 
> leftmost RDN in your server cert's subject DN.  What is the subject DN 
> of your server cert?  You can use certutil -L -n Server-Cert as 
> specified in the Howto:SSL to print your cert.

Running cd /opt/fedora-ds/alias ; ../shared/bin/certutil -L -d . -n 
"server-cert" returns:
certutil-bin: Could not find: server-cert
: security library: bad database.

I can see the Subject DN in "Manage Certificates" --> Server Certs --> 
Detail 
 
 It's the FQDN of the FDS server ( and the OpenSSL CA )


>>>>
>>>> In /etc/ldap.conf, I have put in
>>>> TLS_CACERT /path/to/cert
>>> Is this the same /path/to/cacert.pem as below?
>> Yes
>>>> TLSREQCERT allow
>>>> ssl on
>>>> ssl start_tls
>>>>
>>>> If I run
>>>> openssl s_client -connect localhost:636 -showcerts -state -CAfile 
>>>> /path/to/cacert.pem
>>>>
>>>> It looks OK
>>>>
>>>> Please help
>>>>
>>>> Thanks
>>>>
>>> ------------------------------------------------------------------------ 
>>>
>>>
>>> -- 
>>> Fedora-directory-users mailing list
>>> Fedora-directory-users at redhat.com
>>> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>>>   
>>
>> -- 
>> Fedora-directory-users mailing list
>> Fedora-directory-users at redhat.com
>> https://www.redhat.com/mailman/listinfo/fedora-directory-users
> ------------------------------------------------------------------------
>
> --
> Fedora-directory-users mailing list
> Fedora-directory-users at redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>