<div style="white-space:pre-wrap">Actually, looking at the source code of 389DS it is impossible. I gave up. <a href="http://fossies.org/linux/389-ds-base/ldap/servers/slapd/ssl.c">http://fossies.org/linux/389-ds-base/ldap/servers/slapd/ssl.c</a> (see screenshot) Only RSA and some mysterious Fortezza are allowed. NSS' SSL_ConfigSecureServer actually does support kt_dh, not sure if it applies to ECDH as well. I think working around 389DS' SSL code would be harder than just wrapping port 389 into stunnel, but FreeIPA installer doesn't allow the port 636 to be used by anyone else. Seriously, can we just drop Apache+mod_nss and LDAP+libnss? Instead, have the web GUI wrapped into nginx and LDAP into stunnel? One may argue that there won't be single sign-on, because Kerberos, but is anyone seriously using IE anymore? As you might have seen from a parallel thread, NSS does a terrible job with sslabs by default. It is almost 2016, TLSv1.3 will be released soon, but it barely had support of TLSv1.2.<img src="cid:150dc1764b4dab68c281" style="width:568px; max-width:100%;"> As for now, I suggest writing it in docs and add a check to ipa CLI tools not to allow ECC certs. Marat</div> <div class="gmail_quote"><div dir="ltr">2015年11月6日(金) 17:50 Martin Kosek <<a href="mailto:mkosek@redhat.com">mkosek@redhat.com</a>>: </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On 11/05/2015 02:39 PM, Marat Vyshegorodtsev wrote: > Hi! > > I've been fighting for the past week with FreeIPA and trying to make > it work with my own CA certificate that is ECDSA_SHA256. > > Even though I somehow fixed /etc/httpd/conf.d/nss.conf to make it work > (basically added correct NSSCipherSuite), LDAP (389DS) is a tough nut. > > The command I used is: > > ipa-server-install --mkhomedir --hostname '<a href="http://ipa.mydomain.com" rel="noreferrer" target="_blank">ipa.mydomain.com</a>' --realm > <a href="http://MYDOMAIN.COM" rel="noreferrer" target="_blank">MYDOMAIN.COM</a> --domain <a href="http://mydomain.com" rel="noreferrer" target="_blank">mydomain.com</a> --ds-password 'DS_PASSWORD_HERE' > --admin-password 'ADMIN_PASSWORD_HERE' --no-ntp --unattended > --no-host-dns --dirsrv-cert-file /etc/ipa/ipa.p12 --http-cert-file > /etc/ipa/ipa.p12 --dirsrv-pin 'PIN_FOR_CERT' --http-pin 'PIN_FOR_CERT' > --ca-cert-file /etc/ipa/myownca.pem > > In this case, installation fails at the following step: > Unable to set admin password Command ''/usr/bin/ldappasswd' '-h' > '<a href="http://ipa.rpay.us" rel="noreferrer" target="_blank">ipa.rpay.us</a>' '-ZZ' '-x' '-D' 'cn=Directory Manager' '-y' > '/var/lib/ipa/tmp5KkCae' '-T' '/var/lib/ipa/tmpTC27Ap' > 'uid=admin,cn=users,cn=accounts,dc=rpay,dc=us'' returned non-zero exit > status 1 > > In /var/log/ipaserver-install.log I see a message: > DEBUG stderr=ldap_start_tls: Protocol error (2) > additional info: SSL not supported by this server. > > Basically, LDAP is broken now (it doesn't allow connecting without -ZZ > flag, and fails with it, since TLS is misconfigured at this point). > > What actually happens, LDAP gets configured to use RSA as a key > exchange algorithm, and fails, since the cert is an ECC cert. > > In /var/log/dirsrv/slapd-MYDOMAIN-COM/errors you can see: > [05/Nov/2015:12:22:36 +0000] - SSL alert: ConfigSecureServer: Server > key/certificate is bad for cert FreeIPA of family > cn=RSA,cn=encryption,cn=config (Netscape Portable Runtime error -12200 > - The certificate provided cannot be used with the selected key > exchange algorithm.) > > This is configured by ipaserver/install/dsinstance.py under def __enable_ssl: > > entry = conn.make_entry( > DN(('cn', 'RSA'), ('cn', 'encryption'), ('cn', 'config')), > objectclass=["top", "nsEncryptionModule"], > cn=["RSA"], > nsSSLPersonalitySSL=[self.nickname], > nsSSLToken=["internal (software)"], > nsSSLActivation=["on"], > ) > conn.add_entry(entry) > > My question is, is it possible to replace RSA with ECDSA here? If so, > what parameters should I pass to LDAP? Honza or Ludwig, do you know? This is certainly an uncharted territory, you are the first person I know about trying to install FreeIPA CA-less with ECC certificate. There is a ticket to get ECC support in PKI (i.e. not CA-less), but it was not completed yet: <a href="https://fedorahosted.org/freeipa/ticket/3951" rel="noreferrer" target="_blank">https://fedorahosted.org/freeipa/ticket/3951</a> > > If this is fixable, can someone add autodetect of the type of the > certificate and enable appropriate algorithms in LDAP and Apache? > > Best regards, > Marat Vyshegorodtsev > </blockquote></div>