[Fedora-directory-users] Enabling SSL

[Adam Stokes]

On Wed, 3 Aug 2005 15:48:42 -0400
Kevin Kovach <kovach at gmail.com> wrote:

Kevin,

Again another typo the line should read

pk12util -d . -P slapd-serverID- -o servercert.pk12 -n Server-Cert

and the -P option is the dbprefix in which case slapd-serverID- should
be replaced with whatever you have setup as your slapd-<instance>-

Hope this helps

> Adam,
> 
> My entry looks the same.  I'm pretty certain I have the ciphers
> correct now.
> 
> I am curious about one thing though.  In following the wiki, I did as
> suggested and converted the cert db to pkcs12 with the following
> command ...
> 
> pk12util -d . -P slapd-serverID- -o servercert.pfx -n Server-Cert
> 
> However, I don't see anywhere where we make FDS aware of
> servercert.pfx?  I'd assume that we need to configure FDS for this
> pkcs12 db somewhere?
> 
> Also, the wiki mentions the trailing - on the -P option but does not
> go into depth on it.  I'm pretty sure I executed this command
> correctly but am unsure how to double check it?
> 
> Thanks again.
> 
> - Kevin
> 
> On 8/3/05, Adam Stokes <astokes at redhat.com> wrote:
> > dn: cn=encryption,cn=config
> > objectClass: top
> > objectClass: nsEncryptionConfig
> > cn: encryption
> > nsSSLSessionTimeout: 0
> > nsSSLClientAuth: allowed
> > nsSSL2: off
> > nsSSL3: on
> > creatorsName: cn=server,cn=plugins,cn=config
> > modifiersName: cn=directory manager
> > createTimestamp: 20050701182744Z
> > modifyTimestamp: 20050720192820Z
> > nsSSL3Ciphers:
> > -
> > rsa_null_md5,rsa_rc4_128_md5,rsa_rc4_40_md5,rsa_rc2_40_md5,rsa_des_sha,rsa_fips_des_sha,rsa_3des_sha,rsa_fips_3des_sha,fortezza,fortezza_rc4_128_sha,fortezza_null,tls_rsa_export1024_with_rc4_56_sha,tls_rsa_export1024_with_des_cbc_sha
> > nsKeyfile: alias/slapd-directory-key3.db nsCertfile: alias/slapd-
> > directory-cert8.db numSubordinates: 1
> > 
> > Above is my entry for reference
> > 
> > On Wed, 2005-08-03 at 13:57 -0400, Kevin Kovach wrote:
> > > Thanks Nathan.  I've made this change and again got farther than
> > > I have before.
> > >
> > > FYI, I got that cipher list from the Wiki.  That will need to be
> > > updated to contain the complete list.
> > >
> > > Although I got farther the server is still not starting up.  Now
> > > it's complaining that none of the ciphers are valid?  How to I
> > > ensure that I'm using a valid cypher?  Here's the error I'm
> > > seeing in the error log ...
> > >
> > > [03/Aug/2005:13:56:23 -0400] - Fedora-Directory/7.1
> > > B2005.201.2115 starting up [03/Aug/2005:13:56:23 -0400] - SSL
> > > failure: None of the cipher are valid
> > >
> > > Thanks again for the help.
> > >
> > > - Kevin
> > >
> > > And again have a different issue now.  Now it's complaining that
> > > there are no
> > 
> > 
> > --
> > Fedora-directory-users mailing list
> > Fedora-directory-users at redhat.com
> > https://www.redhat.com/mailman/listinfo/fedora-directory-users
> > 
> 
> 
> -- 
> Take back the web, http://www.switch2firefox.com/
> 
> --
> Fedora-directory-users mailing list
> Fedora-directory-users at redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users


-- 
....<(^_^)> adam stokes....