[Fedora-directory-users] problem with cert for ssl on RHAS5

Satish Chetty satish at suburbia.org.au
Wed Dec 5 04:05:25 UTC 2007


Steven,

Steven Jones wrote:
> Hi,
> 
> I am trying to do a ldapsearch with ssl enabled....and I get this error,

	You can also try ldapsearch that comes with FDS (without -x option)

	Also, if you want only encryption and not host identification, use 
'tls_checkpeer no' in your ldap.conf

-Satish.

> 
> 8><----------
> [root at hack openldap]# ldapsearch -x -ZZ '(uid=jonesst1)'
> ldap_start_tls: Connect error (-11)
>         additional info: TLS: hostname does not match CN in peer
> certificate
> 
> /etc/openldap/ldap.conf looks like this,
> 
> #=========
> #ssl setup
> # http://www.padl.com
> base dc=vuw,dc=ac,dc=nz
> pam_password md5
> BASE dc=vuw,dc=ac,dc=nz
> TLS_REQCERT allow
> #TLS_REQCERT never
> host ldap.vuw.ac.nz
> ssl start_tls
> uri ldap://ldap.vuw.ac.nz/
> tls_cacertdir /etc/openldap/cacerts
> 
> So my understanding was I had the cn= wrong, "cn=vuw.ac.nz" but I have
> corrected this "cn=vuwunicvfdsm001.vuw.ac.nz" and I am still getting the
> error....
> 
> I used this command,
> 
> 7.	Generate the server certificate: 
> ../shared/bin/certutil -S -n "Server-Cert" -s \
> "cn=vuwunicvfdsm001.vuw.ac.nz" -c "CA certificate" -t "u,u,u" -m 1001 -v
> \
> 120 -d . -z noise.txt -f pwdfile.txt
> 
> So what did I do wrong?
> 
> regards
> 
> Steven Jones
> Senior  Linux/Unix/San/Vmware System Administrator
> APG -Technology Integration Team
> Victoria University of Wellington
> Phone: +64 4 463 6272
> 
> --
> Fedora-directory-users mailing list
> Fedora-directory-users at redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
> 




More information about the Fedora-directory-users mailing list