[Fedora-directory-users] Win2003 AD SSL certs

[Richard Megginson]

Jeff Gamsby wrote:
> Thanks,
>
> I tried that, it doesn't seem to matter. When I had it running on a 
> Win2k server, it worked with the "-P ."
Then you probably have a file called cert8.db in that directory.
> I'm wondering if there is anything that has to be done differently 
> when using Win2003 vs. Win2k servers?
Not that I know of.
>
> I guess it could be a DNS problem. I'm looking into that now.
Yes, could be DNS.
>
> Any suggestions are welcome.
>
>
> Richard Megginson wrote:
>> Jeff Gamsby wrote:
>>>
>>> Can someone please tell me if I have this right?
>>>
>>> 1) Create certs for FDS server.
>>> 2) export servercerts on FDS.
>>> 3) install Active Directory and certificate services ( Enterprise 
>>> Root CA )
>>> 4) Setup Active Directory for SSL ( tested with ldp.exe )
>>> 5) Export AD cert, import into FDS
>>> 6) Install PassSync, import servercerts from FDS
>>> 7) Test ldapsearch over SSL to AD.
>>>
>>> I have just upgraded to Windows server 2003 R2 and I can't get SSL 
>>> from FDS to AD working again.
>>>
>>> I get this error.
>>>
>>> ../shared/bin/ldapsearch -Z -P . -h ad-server -p 636 -D 
>>> "cn=administrator,cn=users,dc=xxx,dc=xxx,dc=xxx" -w - -s sub -b 
>>> "cn=users,dc=xxx,dc=xxx,dc=xxx" "cn=*" -v
>> Assuming you're not using cert8.db and key3.db as your key/cert db 
>> names, the argument to -P should be the full path and filename of the 
>> key/cert database e.g. -P /opt/fedora-ds/alias/slapd-instance-cert8.db.
>>
>>>
>>> ldap_simple_bind: Can't contact LDAP server
>>>        SSL error -8179 (Peer's Certificate issuer is not recognized.)
>>>
>>> Thanks in advance.
>>>
>>> J.G.
>>>
>>>
>>>
>>>
>>> -- 
>>> Fedora-directory-users mailing list
>>> Fedora-directory-users at redhat.com
>>> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>> ------------------------------------------------------------------------
>>
>> -- 
>> Fedora-directory-users mailing list
>> Fedora-directory-users at redhat.com
>> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>>   
>
> -- 
> Fedora-directory-users mailing list
> Fedora-directory-users at redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3178 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/fedora-directory-users/attachments/20060718/a6bd740b/attachment.bin>