Re: TLS and Directory Admin

Quoting [email protected]:
> onsdag 26 november 2003, 00:52, skrev Eric Sandall:
> > Quoting Manuel Amador <[email protected]>:
> > > Tarjei Huse contributed a lot for TLS.  He might be able to understand
> > > what is going on.
> ??? I'm not sure about that :-)
> 
> > > Fact of the matter is, things have gotten really complicated on the
> >
> LDAP+Kerberos+TLS+Schemas+Un-standardiness-of-implementations-of-schemas+Pa
> >sswordHashes
> +1
> > TLS certificate verification: Error, unable to get local issuer
> certificate
> 
> I'll try to make this answer a bit longer than normal as I've used some time
> 
> to get this into my head.
> 
> SSL/TLS answers two questions:
> 1. Is the server you are connecting to the one you want to connect to. 
> I.e to prevent man in the middel attacks.
> 
> 2. Encrypt the connection.
> 
> Many people only use TLS for (2), but your problem is related to (1).
> 
> You did not state how you created your cert, so I assume you used CA.pl. I 
> haven't used it for creating my own CA, but the basics are the same anyhow.
> 
> The point is that the ssl libary will try to check the rootcert you created 
> using CA.pl. 
> 
> 	NOTE: If you have not created a CA cert and key, you'll have to do this.
> Take
> 	a look at a package like tiny CA or just use CA.pl.
> 
> To do this, it will try to check the cert against the rootcerts it has 
> installed. I'm not sure what directory OpenSSL checks by default , but I 
> woulc venture /etc/ssl/certs or /usr/share/ssl/certs.
> 
> What you do is copy the ca cert (not the key!) into the certs directory that
> 
> openssl has (on the client machine) and then run c_rehash /path/to/cersdir 
> this should create a hash or the cert and a symlink from the cert to a file 
> named <hash>.0. 
> 
> You can verify that this works by running ldapsearch -ZZ -h yourhost instead
> 
> of -Z the difference is that -Z does just (2) while -ZZ does both (I think).
> 
> Tips: 
> * You might have to add a path to the CA.cert in the ldap.conf file in 
> /etc/openldap as well to get ldapsearch to work.
> * Googling for openssl erromessages will often give help allthough DA is a 
> minbor app beacause the messages are generic.
> * A openldap errormessage containing something like "CTX" is often related to
> 
> filepermissions and wrong paths in the configfile (the errormessage is 
> usually just gibberish).
> 
> 
> 
> I hope this might help a bit.
> Tarjei

I used the CA.sh script provided by openssl (I used the OpenSSL HOWTO to create
all my files, they never mentioned putting the cert file in /etc/ssl/certs/ and
running the c_rehash program, at least that I saw).  I tried your steps, but I
still receive the same problem; it doesn't seem to like my certificates. So for
now I'm not going to use TLS (all the machines are behind a firewall, so none
of this traffic can be seen by outsiders) for now. I think I probably just
messed up the slapd.conf file, but I'm not sure how. I'll continue to muck with
it, but I can't keep the users waiting too long. ;)

Thanks for the help.

-sandalle

-- 
PGP Key Fingerprint:  FCFF 26A1 BE21 08F4 BB91  FAED 1D7B 7D74 A8EF DD61
http://search.keyserver.net:11371/pks/lookup?op=get&search=0xA8EFDD61

-----BEGIN GEEK CODE BLOCK-----
Version: 3.12
GCS/E/IT$ d-- s++:+>: a-- C++(+++) BL++++VIS>$ P+(++) L+++ E-(---) W++ N+@ o?
K? w++++>-- O M-@ V-- PS+(+++) PE(-) Y++(+) PGP++(+) t+() 5++ X(+) R+(++)
tv(--)b++(+++) DI+@ D++(+++) G>+++ e>+++ h---(++) r++ y+
------END GEEK CODE BLOCK------

Eric Sandall                     |  Source Mage GNU/Linux Developer
[email protected]                  |  http://www.sourcemage.org/
http://eric.sandall.us/          |  SysAdmin @ Inst. Shock Physics @ WSU
http://counter.li.org/  #196285  |  http://www.shock.wsu.edu/

----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.


-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills.  Sign up for IBM's
Free Linux Tutorials.  Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click