| Newsgroups |
gmane.network.directoryadmin |
| Message-ID |
<[email protected]> |
onsdag 26 november 2003, 00:52, skrev Eric Sandall:
> Quoting Manuel Amador <[email protected]>:
> > Tarjei Huse contributed a lot for TLS. He might be able to understand
> > what is going on.
??? I'm not sure about that :-)
> > Fact of the matter is, things have gotten really complicated on the
> LDAP+Kerberos+TLS+Schemas+Un-standardiness-of-implementations-of-schemas+Pa
>sswordHashes
+1
> TLS certificate verification: Error, unable to get local issuer certificate
I'll try to make this answer a bit longer than normal as I've used some time
to get this into my head.
SSL/TLS answers two questions:
1. Is the server you are connecting to the one you want to connect to.
I.e to prevent man in the middel attacks.
2. Encrypt the connection.
Many people only use TLS for (2), but your problem is related to (1).
You did not state how you created your cert, so I assume you used CA.pl. I
haven't used it for creating my own CA, but the basics are the same anyhow.
The point is that the ssl libary will try to check the rootcert you created
using CA.pl.
NOTE: If you have not created a CA cert and key, you'll have to do this. Take
a look at a package like tiny CA or just use CA.pl.
To do this, it will try to check the cert against the rootcerts it has
installed. I'm not sure what directory OpenSSL checks by default , but I
woulc venture /etc/ssl/certs or /usr/share/ssl/certs.
What you do is copy the ca cert (not the key!) into the certs directory that
openssl has (on the client machine) and then run c_rehash /path/to/cersdir
this should create a hash or the cert and a symlink from the cert to a file
named <hash>.0.
You can verify that this works by running ldapsearch -ZZ -h yourhost instead
of -Z the difference is that -Z does just (2) while -ZZ does both (I think).
Tips:
* You might have to add a path to the CA.cert in the ldap.conf file in
/etc/openldap as well to get ldapsearch to work.
* Googling for openssl erromessages will often give help allthough DA is a
minbor app beacause the messages are generic.
* A openldap errormessage containing something like "CTX" is often related to
filepermissions and wrong paths in the configfile (the errormessage is
usually just gibberish).
I hope this might help a bit.
Tarjei
> So I don't think (at least yet) it's a DA problem, but most likely a ID10T
> problem on my part, though I've followed the directions[0] to the letter.
> ;(
>
> -sandalle
>
> [0] http://www.openldap.org/faq/data/cache/185.html
-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
Does SourceForge.net help you be more productive? Does it
help you create better code? SHARE THE LOVE, and help us help
YOU! Click Here: http://sourceforge.net/donate/