[Fedora-directory-users] solaris 10 SSL connections

[Michael Montgomery]

I'm really not sure if this will help, but here are the full 
instructions I used to get this working on a clean solaris 9 install (I 
haven't given it a shot on solaris 10 yet)

Download the nspr, and nss packages for Solaris 9 here
(http://sourceforge.net/project/showfiles.php?group_id=19386)
and install them.

Get Sun one Resource Kit here:
http://www.sun.com/download/products.xml?id=3f74a0db
And install it.

Next run this command to setup your certificate database:

# LD_LIBRARY_PATH=/usr/lib:/usr/local/lib ; export LD_LIBRARY_PATH
# /opt/sunone/lib/nss/bin/certutil -N -d /var/ldap

Add hosts entry to /etc/hosts for Ldap server, ** matching the 
certificate name **  (in my case, server-cert).
You'll get this error, which will let you know the name you need to put 
in /etc/hosts: (I couldn't 'pull' it from the cert in any way)

Feb 15 13:31:28 unknown sendmail[2061]: libldap: CERT_VerifyCertName: 
cert server name 'server-cert' does not match 'corporate-ds': SSL 
connection denied

Get CA cert from directory using these commands:

[root at corporate-ds alias]# pwd
/opt/fedora-ds/alias
[root at corporate-ds alias]# ../shared/bin/certutil -L -d . -n "CA 
certificate" -r > /root/cert.der

Copy it to the solaris server, and import it with this:

# /opt/sunone/lib/nss/bin/certutil -A -n "CA certificate" -i 
/export/home/mmont/cert.der -t "CTu,u,u" -d /var/ldap/
Run this command to set ldap client settings on the machine:

# ldapclient -v manual -a authenticationMethod=tls:simple -a 
credentialLevel=proxy \
-a defaultSearchBase="dc=inside,dc=yourdomain,dc=com" \
-a domainName=yourdomain.com -a followReferrals=false \
-a serviceSearchDescriptor="netgroup: 
ou=netgroup,dc=inside,dc=yourdomain,dc=com" \
-a preferredServerList=10.5.1.18 -a 
serviceAuthenticationMethod=pam_ldap:tls:simple \
-a proxyPassword=blahblahblah -a 
proxyDn=cn=proxyagent,ou=profile,dc=inside,dc=yourdomain,dc=com

Restart ldap.client:

# /etc/init.d/ldap.client stop ; sleep 2 ; /etc/init.d/ldap.client start

That should do it. Test settings with id, getent, or ldaplist: (You must 
be root, or sudo to use ldaplist)

# ldaplist -l passwd yournamehere
(This should list your entry in the ldap dir)

I hope this helps someone, and I'm sure I'll attempt to get solaris 10 
working at some point soon.