[Fedora-directory-users] Failover and SSL

[Andreas Kekkou]

Hi Rubin,

You can achieve this very easily. Just setup a CA and have your servers' 
certificates signed by your CA. Then copy the CA certificate to your 
clients (/etc/openldap/cacerts) and you are done.

Andreas

Rubin wrote:
> Hi all!
>
> I'm trying to figure out how to handle high availability in           
> combination with ssl. I have ssl working for both clients and
> server to server connections. The problem is that i would like to
> give a client only one ip/fqdn for the ldap server, like
> ldap.example.com and manage failover to a second ldap multimaster
> machine by bringing up that ip or switching the dns entry of the
> fqdn to the at that moment designated as active ldap server.
>
> The problem lies in the fact that the certificate on the client
> has a dn that has to match the hostname to be contacted (ie.
> ldap.example.com) but i don't want to have identical certificates
> on the ldap servers (if the dn does not match the hostname to be contacted,
> connection will fail, verified with openssl).
>
> So how can you have a client contact ldap.example.com with ssl enabled
> while having the ability to switch ldap.example.com between two machines
> without douing something evilish like having identical certificates for
> both ldap servers? How are others handling these things?
>
> The reason i want to do failover this way has to do with wanting
> to avoid the posibility of possible conflicts when having the
> ability to write to 2 masters at the same time.
>
> Thanks for any pointers and/or eyeopeners!
>
> Grtz,
>
> Rubin.
>
> --
> Fedora-directory-users mailing list
> Fedora-directory-users at redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>
>   
-------------- next part --------------
A non-text attachment was scrubbed...
Name: kekkou.a.vcf
Type: text/x-vcard
Size: 303 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/fedora-directory-users/attachments/20070723/a86022d3/attachment.vcf>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3655 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/fedora-directory-users/attachments/20070723/a86022d3/attachment.bin>