sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-13 13:18:06 +03:00
Code

Fixed formatting.

Browse Source 
(This used to be commit 4ea4e60ef4)
This commit is contained in:
John Terpstra 2005-05-19 00:54:42 +00:00 committed by Gerald W. Carter
parent e4340040b4
commit 0760564a72
1 changed files with 291 additions and 307 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

598
docs/Samba-HOWTO-Collection/TOSHARG-SecureLDAP.xml
View File

@ -1,130 +1,104 @@
<?xml version="1.0" encoding="iso-8859-1"?> <?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc"> <!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
<chapter id="ch-ldap-tls"> <chapter id="ch-ldap-tls">
<title>Transport Layer Security</title> <title>Transport Layer Security</title>
<sect1 id="s1-intro-ldap-tls">
<title>Introduction</title> <sect1 id="s1-intro-ldap-tls">
<para> <title>Introduction</title>
<indexterm>
<primary>Transport Layer Seccurity, TLS</primary>
<secondary>Introduction</secondary>
</indexterm>
Up until now, we have discussed the straight forward configuration of
<trademark>OpenLDAP</trademark>, with some advanced features such as
<xref linkend="s1-acls"></xref>. This does not however, deal with the
fact that the network transmissions are still in plain text. This is
where <firstterm>Transport Layer Security (TLS)</firstterm> comes in.
</para>
<para>
<trademark>OpenLDAP</trademark> clients and servers are capable of
using the Transport Layer Security (TLS) framework to provide
integrity and confidentiality protections in accordance with -
<ulink url="http://rfc.net/rfc2830.html">RFC2830</ulink>;
<emphasis>Lightweight Directory Access Protocol (v3): Extension
for Transport Layer Security</emphasis>
</para>
<para>
TLS uses X.509 certificates. All servers are required to have valid
certificates, whereas client certificates are optional. We will only
be discussing server certificates.
<tip>
<para>
The DN of a server certificate must use the CN attribute to name the
server, and the CN must carry the server's fully qualified domain name
(FQDN). Additional alias names and wildcards may be present in the
<option>subjectAltName</option> certificate extension. More details on
server certificate names are in
<ulink url="http://rfc.net/rfc2830.html">RFC2830</ulink>.
</para>
</tip>
</para>
<para>
We will discuss this more in the next sections.
</para>
</sect1>
<sect1 id="s1-config-ldap-tls">
<title>Configuring</title>
<para>
<indexterm>
<primary>Transport Layer Seccurity, TLS</primary>
<secondary>Configuring</secondary>
</indexterm>
Now on to the good bit.
</para>
<sect2 id="s1-config-ldap-tls-certs">
<title>Generating the Certificate Authority</title>
<para>
In order to create the relevant certificates, we need to become our own
Certificate Authority (CA).
<footnote>
<para>
We could however, get our generated server certificate signed by proper CAs,
like <ulink url="http://www.thawte.com/">Thawte</ulink> and
<ulink url="http://www.verisign.com/">VeriSign</ulink>, which you pay for,
or the free ones, via <ulink url="http://www.cacert.org/">CAcert</ulink>
</para>
</footnote>
This is necessary, so we can sign the server certificate.
</para>
<para>
We will be using the <ulink url="http://www.openssl.org">OpenSSL</ulink>
<footnote>
<para>
The downside to making our own CA, is that the certificate is not automatically
recognised by clients, like the commercial ones are.
</para>
</footnote>
software for this, which is included with every great
<trademark class="registered">Linux</trademark> distribution.
</para>
<para>
TLS is used for many types of servers, but the instructions
<footnote>
<para>
For information straight from the horses mouth, please visit -
<ulink url="http://www.openssl.org/docs/HOWTO/">
ttp://www.openssl.org/docs/HOWTO/</ulink>; the main OpenSSL site.
</para>
</footnote>
presented here, are tailored for &OL;.
<note>
<para>
The <emphasis>Common Name (CN)</emphasis>, if the following example,
<emphasis>MUST</emphasis> be the fully qualified domain name (fqdn)
of your ldap server.
</para>
</note>
</para>
<para> <para>
First we need to generate the CA: <indexterm><primary>Transport Layer Seccurity, TLS</primary><secondary>Introduction</secondary></indexterm>
<screen width="90"> Up until now, we have discussed the straight forward configuration of <trademark>OpenLDAP</trademark>,
<computeroutput> with some advanced features such as ACLs. This does not however, deal with the fact that the network
[ghenry@suretec ldap-docs]$ mkdir myCA transmissions are still in plain text. This is where <firstterm>Transport Layer Security (TLS)</firstterm>
</computeroutput> comes in.
</screen> </para>
Move into that directory:
<screen width="90"> <para>
<computeroutput> <trademark>OpenLDAP</trademark> clients and servers are capable of using the Transport Layer Security (TLS)
[ghenry@suretec ldap-docs]$ cd myCA framework to provide integrity and confidentiality protections in accordance with - <ulink
</computeroutput> url="http://rfc.net/rfc2830.html">RFC2830</ulink>; <emphasis>Lightweight Directory Access Protocol (v3):
</screen> Extension for Transport Layer Security.</emphasis>
Now generate the CA: </para>
<footnote>
<para> <para>
Your <filename>CA.pl</filename> or <filename>CA.sh</filename> might TLS uses X.509 certificates. All servers are required to have valid certificates, whereas client certificates
not be in the same location as mine is, you can find it by using the are optional. We will only be discussing server certificates.
<command>locate</command> command, i.e. <command>locate CA.pl</command>. </para>
If the command complains about the database being too old, run
<command>updatedb</command> as <emphasis>root</emphasis> to update it. <tip><para>
</para> The DN of a server certificate must use the CN attribute to name the server, and the CN must carry the
</footnote> server's fully qualified domain name (FQDN). Additional alias names and wildcards may be present in the
<screen width="90"> <option>subjectAltName</option> certificate extension. More details on server certificate names are in <ulink
<computeroutput> url="http://rfc.net/rfc2830.html">RFC2830</ulink>.
[ghenry@suretec myCA]$ /usr/share/ssl/misc/CA.pl -newca </para></tip>
<para>
We will discuss this more in the next sections.
</para>
</sect1>
<sect1 id="s1-config-ldap-tls">
<title>Configuring</title>
<para>
<indexterm><primary>Transport Layer Seccurity, TLS</primary><secondary>Configuring</secondary></indexterm>
Now on to the good bit.
</para>
<sect2 id="s1-config-ldap-tls-certs">
<title>Generating the Certificate Authority</title>
<para>
In order to create the relevant certificates, we need to become our own Certificate Authority (CA).
<footnote><para>We could however, get our generated server certificate signed by proper CAs, like <ulink
url="http://www.thawte.com/">Thawte</ulink> and <ulink url="http://www.verisign.com/">VeriSign</ulink>, which
you pay for, or the free ones, via <ulink url="http://www.cacert.org/">CAcert</ulink>
</para></footnote> This is necessary, so we can sign the server certificate.
</para>
<para>
We will be using the <ulink url="http://www.openssl.org">OpenSSL</ulink> <footnote><para>The downside to
making our own CA, is that the certificate is not automatically recognised by clients, like the commercial
ones are.</para></footnote> software for this, which is included with every great <trademark
class="registered">Linux</trademark> distribution.
</para>
<para>
TLS is used for many types of servers, but the instructions<footnote><para>For information straight from the
horses mouth, please visit - <ulink
url="http://www.openssl.org/docs/HOWTO/">http://www.openssl.org/docs/HOWTO/</ulink>; the main OpenSSL
site.</para></footnote> presented here, are tailored for &OL;.
</para>
<note><para>
The <emphasis>Common Name (CN)</emphasis>, if the following example, <emphasis>MUST</emphasis> be
the fully qualified domain name (fqdn) of your ldap server.
</para></note>
<para>
First we need to generate the CA:
<screen width="90">
<computeroutput>
&rootprompt; mkdir myCA
</computeroutput>
</screen>
Move into that directory:
<screen width="90">
<computeroutput>
&rootprompt; cd myCA
</computeroutput>
</screen>
Now generate the CA:<footnote><para>Your <filename>CA.pl</filename> or <filename>CA.sh</filename> might not be
in the same location as mine is, you can find it by using the <command>locate</command> command, i.e.
<command>locate CA.pl</command>. If the command complains about the database being too old, run
<command>updatedb</command> as <emphasis>root</emphasis> to update it.</para></footnote>
<screen width="90">
<computeroutput>
&rootprompt; /usr/share/ssl/misc/CA.pl -newca
CA certificate filename (or enter to create) CA certificate filename (or enter to create)
Making CA certificate ... Making CA certificate ...
Generating a 1024 bit RSA private key Generating a 1024 bit RSA private key
.......................++++++ .......................++++++
@ -140,42 +114,47 @@ There are quite a few fields but you can leave some blank
For some fields there will be a default value, For some fields there will be a default value,
If you enter '.', the field will be left blank. If you enter '.', the field will be left blank.
----- -----
Country Name (2 letter code) [AU]:GB Country Name (2 letter code) [AU]:AU
State or Province Name (full name) [Some-State]:Aberdeenshire State or Province Name (full name) [Some-State]:NSW
Locality Name (eg, city) []:Aberdeen Locality Name (eg, city) []:Sydney
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Suretec Systems Ltd. Organization Name (eg, company) [Internet Widgits Pty Ltd]:Abmas
Organizational Unit Name (eg, section) []:IT Organizational Unit Name (eg, section) []:IT
Common Name (eg, YOUR name) []:ldap.suretecsystems.com Common Name (eg, YOUR name) []:ldap.abmas.biz
Email Address []:support@suretecsystems.com Email Address []:support@abmas.biz
</computeroutput> </computeroutput>
</screen> </screen>
</para> </para>
<para>
Now, there are some things to note here.
<orderedlist>
<listitem>
<para>
You <emphasis>MUST</emphasis> remember the password, as we will need
it to sign the server certificate..
</para>
</listitem>
<listitem>
<para>
The <emphasis>Common Name (CN)</emphasis>, <emphasis>MUST</emphasis> be the
fully qualified domain name (fqdn) of your ldap server.
</para>
</listitem>
</orderedlist>
</para>
</sect2>
<sect2 id="s1-config-ldap-tls-server">
<title>Generating the Server Certificate</title>
<para> <para>
Now we need to generate the server certificate: Now, there are some things to note here.
<screen width="90"> </para>
<computeroutput>
[ghenry@suretec myCA]$ openssl req -new -nodes -keyout newreq.pem -out newreq.pem <orderedlist>
<listitem>
<para>
You <emphasis>MUST</emphasis> remember the password, as we will need
it to sign the server certificate..
</para>
</listitem>
<listitem>
<para>
The <emphasis>Common Name (CN)</emphasis>, <emphasis>MUST</emphasis> be the
fully qualified domain name (fqdn) of your ldap server.
</para>
</listitem>
</orderedlist>
</sect2>
<sect2 id="s1-config-ldap-tls-server">
<title>Generating the Server Certificate</title>
<para>
Now we need to generate the server certificate:
<screen width="90">
<computeroutput>
&rootprompt; openssl req -new -nodes -keyout newreq.pem -out newreq.pem
Generating a 1024 bit RSA private key Generating a 1024 bit RSA private key
.............++++++ .............++++++
........................................................++++++ ........................................................++++++
@ -188,72 +167,76 @@ There are quite a few fields but you can leave some blank
For some fields there will be a default value, For some fields there will be a default value,
If you enter '.', the field will be left blank. If you enter '.', the field will be left blank.
----- -----
Country Name (2 letter code) [AU]:GB Country Name (2 letter code) [AU]:AU
State or Province Name (full name) [Some-State]:Aberdeenshire State or Province Name (full name) [Some-State]:NSW
Locality Name (eg, city) []:Aberdeen Locality Name (eg, city) []:Sydney
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Suretec Systems Ltd. Organization Name (eg, company) [Internet Widgits Pty Ltd]:Abmas
Organizational Unit Name (eg, section) []:IT Organizational Unit Name (eg, section) []:IT
Common Name (eg, YOUR name) []:ldap.suretecsystems.com Common Name (eg, YOUR name) []:ldap.abmas.biz
Email Address []:support@suretecsystems.com Email Address []:support@abmas.biz
Please enter the following 'extra' attributes Please enter the following 'extra' attributes
to be sent with your certificate request to be sent with your certificate request
A challenge password []: A challenge password []:
An optional company name []: An optional company name []:
</computeroutput> </computeroutput>
</screen> </screen>
</para> </para>
<para> <para>
Again, there are some things to note here. Again, there are some things to note here.
<orderedlist>
<listitem>
<para>
You should <emphasis>NOT</emphasis> enter a password.
</para>
</listitem>
<listitem>
<para>
The <emphasis>Common Name (CN)</emphasis>, <emphasis>MUST</emphasis> be
the fully qualified domain name (fqdn) of your ldap server.
</para>
</listitem>
</orderedlist>
</para> </para>
<orderedlist>
<listitem>
<para>
You should <emphasis>NOT</emphasis> enter a password.
</para>
</listitem>
<listitem>
<para>
The <emphasis>Common Name (CN)</emphasis>, <emphasis>MUST</emphasis> be
the fully qualified domain name (fqdn) of your ldap server.
</para>
</listitem>
</orderedlist>
<para> <para>
Now, we sign the certificate with the new CA: Now, we sign the certificate with the new CA:
<screen width="90"> <screen width="90">
<computeroutput> <computeroutput>
[ghenry@suretec myCA]$ /usr/share/ssl/misc/CA.pl -sign &rootprompt; /usr/share/ssl/misc/CA.pl -sign
Using configuration from /etc/ssl/openssl.cnf Using configuration from /etc/ssl/openssl.cnf
Enter pass phrase for ./demoCA/private/cakey.pem: Enter pass phrase for ./demoCA/private/cakey.pem:
Check that the request matches the signature Check that the request matches the signature
Signature ok Signature ok
Certificate Details: Certificate Details:
Serial Number: 1 (0x1) Serial Number: 1 (0x1)
Validity Validity
Not Before: Mar 6 18:22:26 2005 GMT Not Before: Mar 6 18:22:26 2005 EDT
Not After : Mar 6 18:22:26 2006 GMT Not After : Mar 6 18:22:26 2006 EDT
Subject: Subject:
countryName = GB countryName = AU
stateOrProvinceName = Aberdeenshire stateOrProvinceName = NSW
localityName = Aberdeen localityName = Sydney
organizationName = Suretec Systems Ltd. organizationName = Abmas
organizationalUnitName = IT organizationalUnitName = IT
commonName = ldap.suretecsystems.com commonName = ldap.abmas.biz
emailAddress = support@suretecsystems.com emailAddress = support@abmas.biz
X509v3 extensions: X509v3 extensions:
X509v3 Basic Constraints: X509v3 Basic Constraints:
CA:FALSE CA:FALSE
Netscape Comment: Netscape Comment:
OpenSSL Generated Certificate OpenSSL Generated Certificate
X509v3 Subject Key Identifier: X509v3 Subject Key Identifier:
F7:84:87:25:C4:E8:46:6D:0F:47:27:91:F0:16:E0:86:6A:EE:A3:CE F7:84:87:25:C4:E8:46:6D:0F:47:27:91:F0:16:E0:86:6A:EE:A3:CE
X509v3 Authority Key Identifier: X509v3 Authority Key Identifier:
keyid:27:44:63:3A:CB:09:DC:B1:FF:32:CC:93:23:A4:F1:B4:D5:F0:7E:CC keyid:27:44:63:3A:CB:09:DC:B1:FF:32:CC:93:23:A4:F1:B4:D5:F0:7E:CC
DirName:/C=GB/ST=Aberdeenshire/L=Aberdeen/O=Suretec Systems Ltd./OU=IT/CN=ldap.suretecsystems.com/emailAddress=support@suretecsystems.com DirName:/C=AU/ST=NSW/L=Sydney/O=Abmas/OU=IT/CN=ldap.abmas.biz/emailAddress=support@abmas.biz
serial:00 serial:00
Certificate is to be certified until Mar 6 18:22:26 2006 GMT (365 days) Certificate is to be certified until Mar 6 18:22:26 2006 EDT (365 days)
Sign the certificate? [y/n]:y Sign the certificate? [y/n]:y
@ -261,89 +244,90 @@ Sign the certificate? [y/n]:y
Write out database with 1 new entries Write out database with 1 new entries
Data Base Updated Data Base Updated
Signed certificate is in newcert.pem Signed certificate is in newcert.pem
</computeroutput> </computeroutput>
</screen> </screen>
</para> </para>
<para> <para>
That completes the server certificate generation. That completes the server certificate generation.
</para> </para>
</sect2>
<sect2 id="s1-config-ldap-tls-install"> </sect2>
<sect2 id="s1-config-ldap-tls-install">
<title>Installing the Certificates</title> <title>Installing the Certificates</title>
<para> <para>
Now we need to copy the certificates to the right configuration directories, Now we need to copy the certificates to the right configuration directories,
rename them at the same time for convenience, change the ownership and rename them at the same time for convenience, change the ownership and
finally the permissions: finally the permissions:
<screen width="90"> <screen width="90">
<computeroutput> <computeroutput>
[ghenry@suretec myCA]$ cp demoCA/cacert.pem /etc/openldap/ &rootprompt; cp demoCA/cacert.pem /etc/openldap/
[ghenry@suretec myCA]$ cp newcert.pem /etc/openldap/servercrt.pem &rootprompt; cp newcert.pem /etc/openldap/servercrt.pem
[ghenry@suretec myCA]$ cp newreq.pem /etc/openldap/serverkey.pem &rootprompt; cp newreq.pem /etc/openldap/serverkey.pem
[ghenry@suretec myCA]$ chown ldap.ldap /etc/openldap/*.pem &rootprompt; chown ldap.ldap /etc/openldap/*.pem
[ghenry@suretec myCA]$ chmod 640 /etc/openldap/cacert.pem; chmod 600 /etc/openldap/serverkey.pem &rootprompt; chmod 640 /etc/openldap/cacert.pem; chmod 600 /etc/openldap/serverkey.pem
</computeroutput> </computeroutput>
</screen> </screen>
</para> </para>
<para> <para>
Now we just need to add these locations to <filename>slapd.conf</filename>, Now we just need to add these locations to <filename>slapd.conf</filename>,
anywhere before the <option>database</option> declaration and <filename>ldap.conf</filename>: anywhere before the <option>database</option> declaration as shown here:
</para> <screen width="90">
<para> <computeroutput>
<filename>slapd.conf</filename>
<screen width="90">
<computeroutput>
TLSCertificateFile /etc/openldap/servercrt.pem TLSCertificateFile /etc/openldap/servercrt.pem
TLSCertificateKeyFile /etc/openldap/serverkey.pem TLSCertificateKeyFile /etc/openldap/serverkey.pem
TLSCACertificateFile /etc/openldap/cacert.pem TLSCACertificateFile /etc/openldap/cacert.pem
</computeroutput> </computeroutput>
</screen> </screen>
</para> </para>
<para>
<filename>ldap.conf</filename>
<screen width="90">
<computeroutput>
TLS_CACERT /etc/openldap/cacert.pem
</computeroutput>
</screen>
</para>
<para>
That's all there is to it. Now on to <xref linkend="s1-test-ldap-tls"></xref>
</para>
</sect2>
</sect1>
<sect1 id="s1-test-ldap-tls"> <para>
<title>Testing</title> Here is the declaration and <filename>ldap.conf</filename>:
<para> <filename>ldap.conf</filename>
<indexterm> <screen width="90">
<primary>Transport Layer Seccurity, TLS</primary> <computeroutput>
<secondary>Testing</secondary> TLS_CACERT /etc/openldap/cacert.pem
</indexterm> </computeroutput>
This is the easy part. Restart the server: </screen>
<screen width="90"> </para>
<computeroutput>
[ghenry@suretec myCA]$ /etc/init.d/ldap restart <para>
That's all there is to it. Now on to <xref linkend="s1-test-ldap-tls"></xref>
</para>
</sect2>
</sect1>
<sect1 id="s1-test-ldap-tls">
<title>Testing</title>
<para>
<indexterm><primary>Transport Layer Seccurity, TLS</primary><secondary>Testing</secondary></indexterm>
This is the easy part. Restart the server:
<screen width="90">
<computeroutput>
&rootprompt; /etc/init.d/ldap restart
Stopping slapd: [ OK ] Stopping slapd: [ OK ]
Checking configuration files for slapd: config file testing succeeded Checking configuration files for slapd: config file testing succeeded
Starting slapd: [ OK ] Starting slapd: [ OK ]
</computeroutput> </computeroutput>
</screen> </screen>
Then, using <command>ldapsearch</command>, test an anonymous search with the <option>-ZZ</option> Then, using <command>ldapsearch</command>, test an anonymous search with the
<footnote> <option>-ZZ</option><footnote><para>See <command>man ldapsearch</command></para></footnote> option:
<para> <screen width="90">
See <command>man ldapsearch</command>: <computeroutput>
</para> &rootprompt; ldapsearch -x -b "dc=ldap,dc=abmas,dc=biz" -H 'ldap://ldap.abmas.biz:389' -ZZ
</footnote> </computeroutput>
option: </screen>
<screen width="90">
<computeroutput>
[ghenry@suretec myCA]$ ldapsearch -x -b "dc=ldap,dc=suretecsystems,dc=com" -H 'ldap://ldap.suretecsystems.com:389' -ZZ
</computeroutput>
</screen>
Your results should be the same as before you restarted the server, for example: Your results should be the same as before you restarted the server, for example:
<screen width="90"> <screen width="90">
<computeroutput> <computeroutput>
[ghenry@suretec myCA]$ ldapsearch -x -b "dc=ldap,dc=suretecsystems,dc=com" -H 'ldap://ldap.suretecsystems.com:389' -ZZ &rootprompt; ldapsearch -x -b "dc=ldap,dc=abmas,dc=biz" \
-H 'ldap://ldap.abmas.biz:389' -ZZ
# extended LDIF # extended LDIF
# #
@ -353,54 +337,54 @@ Starting slapd: [ OK ]
# requesting: ALL # requesting: ALL
# #
# suretecsystems.com # abmas.biz
dn: dc=ldap,dc=suretecsystems,dc=com dn: dc=ldap,dc=abmas,dc=biz
objectClass: dcObject objectClass: dcObject
objectClass: organization objectClass: organization
o: Suretec Systems Ltd. o: Abmas
dc: suretecsystems dc: abmas
# Manager, ldap.suretecsystems.com # Manager, ldap.abmas.biz
dn: cn=Manager,dc=ldap,dc=suretecsystems,dc=com dn: cn=Manager,dc=ldap,dc=abmas,dc=biz
objectClass: organizationalRole objectClass: organizationalRole
cn: Manager cn: Manager
# SURETEC, suretecsystems.com # ABMAS, abmas.biz
dn: sambaDomainName=SURETEC,dc=ldap,dc=suretecsystems,dc=com dn: sambaDomainName=ABMAS,dc=ldap,dc=abmas,dc=biz
sambaDomainName: SURETEC sambaDomainName: ABMAS
sambaSID: S-1-5-21-238355452-1056757430-1592208922 sambaSID: S-1-5-21-238355452-1056757430-1592208922
sambaAlgorithmicRidBase: 1000 sambaAlgorithmicRidBase: 1000
objectClass: sambaDomain objectClass: sambaDomain
sambaNextUserRid: 67109862 sambaNextUserRid: 67109862
sambaNextGroupRid: 67109863 sambaNextGroupRid: 67109863
</computeroutput> </computeroutput>
</screen> </screen>
If you have any problems, please read <xref linkend="s1-int-ldap-tls"></xref> If you have any problems, please read <xref linkend="s1-int-ldap-tls"></xref>
</para> </para>
</sect1>
<sect1 id="s1-int-ldap-tls"> </sect1>
<title>Troubleshooting</title>
<para> <sect1 id="s1-int-ldap-tls">
<indexterm> <title>Troubleshooting</title>
<primary>Transport Layer Seccurity, TLS</primary>
<secondary>Troubleshooting</secondary> <para>
</indexterm> <indexterm><primary>Transport Layer Seccurity, TLS</primary><secondary>Troubleshooting</secondary></indexterm>
The most common error when configuring TLS, as I have already mentioned The most common error when configuring TLS, as I have already mentioned numerous times, is that the
numerous times, is that the <emphasis>Common Name (CN)</emphasis> you entered <emphasis>Common Name (CN)</emphasis> you entered in <xref linkend="s1-config-ldap-tls-server"></xref> is
in <xref linkend="s1-config-ldap-tls-server"></xref> is <emphasis>NOT</emphasis> <emphasis>NOT</emphasis> the Full Qualified Domain Name (FQDN) of your ldap server.
the Full Qualified Domain Name (FQDN) of your ldap server. </para>
</para>
<para>Other errors could be that you have a typo somewhere in your <para>
<command>ldapsearch</command> command, or that your have the wrong Other errors could be that you have a typo somewhere in your <command>ldapsearch</command> command, or that
permissions on the <filename>servercrt.pem</filename> and your have the wrong permissions on the <filename>servercrt.pem</filename> and <filename>cacert.pem</filename>
<filename>cacert.pem</filename> files. They should be set with files. They should be set with <command>chmod 640</command>, as per <xref
<command>chmod 640</command>, as per <xref linkend="s1-config-ldap-tls-install"></xref>. linkend="s1-config-ldap-tls-install"></xref>.
</para> </para>
<para>
For anything else, it's best to read through your ldap logfile or <para>
join the &OL; mailing list. For anything else, it's best to read through your ldap logfile or join the &OL; mailing list.
</para> </para>
</sect1>
</sect1>
</chapter> </chapter>