[Fedora-directory-users] problem with SSL and load balance
Marc Sauton
msauton at redhat.com
Wed Oct 3 20:36:26 UTC 2007
Just for info, there was a good contribution in
http://directory.fedoraproject.org/wiki/Howto:SSL#Using_Subject_Alt_Name
M.
Enrico M. V. Fasanelli wrote:
> Hi Victor,
>
> have you tried with a certificate that contains the alternate name of
> the server?
>
> Something like
> X509v3 Subject Alternative Name: DNS:fds.mydomain.com,
> DNS:fds1.mydomain.com
>
>
> Ciao,
> Enrico
>
> Victor Hugo dos Santos wrote:
>> Hello List,
>>
>> I have the same problem that Alex Aka in Apr 2006
>> http://www.redhat.com/archives/fedora-directory-users/2006-April/msg00022.html
>>
>>
>> I have two FDS (fds1 and fds2) in MMR
>>
>> in the DNS I create this machines
>>
>> fds1 IN A 10.0.0.11
>> fds2 IN A 10.0.0.12
>> fds IN A 10.0.0.11
>> fds IN A 10.0.0.12
>>
>> in the clients, I configure the ldap.conf with this parameters:
>>
>> BASE dc=mydomain,dc=com
>> URI ldap://fds.mydomain.com
>>
>> this configuration work very,very fine !!!! exist replication between
>> servers and fault tolerance in the clients.. but i enable SSL in
>> server and in the clients (ldap.conf)
>>
>>
>> BASE dc=mydomain,dc=com
>> URI ldaps://fds.mydomain.com
>> TLS_CACERT /etc/ssl/certs/cacert.org.pem
>> TLS_REQCERT allow
>>
>> and "no" work !!! :-( i receive this error:
>>
>> ldap_bind: Can't contact LDAP server (-1)
>>
>> additional info: TLS: hostname does not match CN in peer certificate
>>
>> this problem, is derivate that i configured the servers with one
>> certificate and distinct CN for independent serves (fds1 and fds2)...
>>
>> if I config one same certificate with same CN (fds) for both nodes
>> (fds1 and fds2).. work fine in the clients, but the replication dont
>> work !!! :-(
>>
>> obs.: my certificates is sign in http://cacert.org
>>
>> any idea or suggestion ???
>>
>> thanks
>>
>>
>
> ------------------------------------------------------------------------
>
> --
> Fedora-directory-users mailing list
> Fedora-directory-users at redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>
More information about the Fedora-directory-users
mailing list