Home / server / Questions / 432806
In Process
blindsnowmobile
Asked: 2012-09-28 18:59:48 +0800 CST

Start TLS and 389 Directory

  • 772

I'm trying to configure Start TLS on 389 Directory server, but I'm having all sorts of issues.

I've been following this doc: https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Directory_Server/9.0/html/Administration_Guide/managing-certs.html

which specifies that I should create a certificate for both the directory server and admin server. I've imported the CA cert on both servers. I've tried to use the same server certificate for both. It will not allow me to do so. However, the admin and directory servers reside on the same host. If I generate a new certificate it will need to use the same hostname. I'm not sure if that's valid...

Has anyone out there set this up before? Any direction would be helpful. I have multmaster replication set up. From an external client, I'm attempting to do an ldapsearch -ZZ -x -h "myhost" -b "dc=example,dc=com" -D "cn=Directory Manager" -W "", and I'm getting a protocol error.

redhat

1 Answers

  1. which specifies that I should create a certificate for both the directory server and admin server.

    You dont need certificate for both admin & directory server if it is not required in your environment. Could you use below link to configure SSL in 389-ds.

    http://lists.fedoraproject.org/pipermail/389-users/2012-March/014200.html

    • 1