[Fedora-directory-users] SSL problem on replication!

[Susan]

This is what I did to get ssl repl working:

1. generate a single CA certificate and use that to sign both the supplier and consumer
certificates. Each server doesn't need its own CA.

on the consumer:

[root at cnjldap01 alias]# ../shared/bin/certutil -L -d . -n "NJ CA certificate" -a >
cnjldap01.cert.asc

#send to supplier:

scp cnjldap01.cert.asc root at cnyldap01:/opt/fedora-ds/alias/

#import it into the supplier's cert db:

[root at cnyldap01 /]# ../shared/bin/certutil -A -d . -P slapd-cnyldap01- -n "NJ CA certificate" -t
"CT,," -a -i cnjldap01.cert.asc 


That's it.


--- Richard Megginson <rmeggins at redhat.com> wrote:

> Alex aka Magobin wrote:
> > hi,
> > I used Replication HOWTO to make a replica with 2 server; after that I
> > saw  that replication was  without encryption, so I maked my own CA
> > Authority and I maked two certificate for both server...I maked request
> > from Fedora Console and then I installed it from same console.
> >
> > Testing on second server, I tried to restart slapd, but when I tried the
> > server ask correctly PIN for Internal Software Token, but then it says:
> >
> > 22/Mar/2006:11:20:39 +0100] - SSL alert: CERT_VerifyCertificateNow:
> > verify certificate failed for cert nodo2-cert of family
> > cn=RSA,cn=encryption,cn=config (Netscape Portable Runtime error -8179 -
> > Peer's Certificate issuer is not recognized.)
> > [22/Mar/2006:11:20:39 +0100] - SSL failure: None of the cipher are valid
> >
> >
> >
> > ...what does it mean?...maybe that I have maked some mistakes about ssl?
> > ...how can I resolv this problem?
> > ...is it possible to come back??
> >   
> I think you may need to add the CA cert to the cert db for nodo2
> >
> > thanks in advance
> >
> > Alex
> >
> > --
> > Fedora-directory-users mailing list
> > Fedora-directory-users at redhat.com
> > https://www.redhat.com/mailman/listinfo/fedora-directory-users
> >   
> > --
> Fedora-directory-users mailing list
> Fedora-directory-users at redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
> 


__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com