[Fedora-directory-users] SSL problem on replication!
Susan
logastellus at yahoo.com
Thu Mar 23 16:43:31 UTC 2006
This is what I did to get ssl repl working:
1. generate a single CA certificate and use that to sign both the supplier and consumer
certificates. Each server doesn't need its own CA.
on the consumer:
[root at cnjldap01 alias]# ../shared/bin/certutil -L -d . -n "NJ CA certificate" -a >
cnjldap01.cert.asc
#send to supplier:
scp cnjldap01.cert.asc root at cnyldap01:/opt/fedora-ds/alias/
#import it into the supplier's cert db:
[root at cnyldap01 /]# ../shared/bin/certutil -A -d . -P slapd-cnyldap01- -n "NJ CA certificate" -t
"CT,," -a -i cnjldap01.cert.asc
That's it.
--- Richard Megginson <rmeggins at redhat.com> wrote:
> Alex aka Magobin wrote:
> > hi,
> > I used Replication HOWTO to make a replica with 2 server; after that I
> > saw that replication was without encryption, so I maked my own CA
> > Authority and I maked two certificate for both server...I maked request
> > from Fedora Console and then I installed it from same console.
> >
> > Testing on second server, I tried to restart slapd, but when I tried the
> > server ask correctly PIN for Internal Software Token, but then it says:
> >
> > 22/Mar/2006:11:20:39 +0100] - SSL alert: CERT_VerifyCertificateNow:
> > verify certificate failed for cert nodo2-cert of family
> > cn=RSA,cn=encryption,cn=config (Netscape Portable Runtime error -8179 -
> > Peer's Certificate issuer is not recognized.)
> > [22/Mar/2006:11:20:39 +0100] - SSL failure: None of the cipher are valid
> >
> >
> >
> > ...what does it mean?...maybe that I have maked some mistakes about ssl?
> > ...how can I resolv this problem?
> > ...is it possible to come back??
> >
> I think you may need to add the CA cert to the cert db for nodo2
> >
> > thanks in advance
> >
> > Alex
> >
> > --
> > Fedora-directory-users mailing list
> > Fedora-directory-users at redhat.com
> > https://www.redhat.com/mailman/listinfo/fedora-directory-users
> >
> > --
> Fedora-directory-users mailing list
> Fedora-directory-users at redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
More information about the Fedora-directory-users
mailing list