[Fedora-directory-users] problem with SSL and load balance

[Enrico M. V. Fasanelli]

Hi Victor,

have you tried with a certificate that contains the alternate name of 
the server?

Something like
X509v3 Subject Alternative Name: DNS:fds.mydomain.com, 
DNS:fds1.mydomain.com


Ciao,
	Enrico

Victor Hugo dos Santos wrote:
> Hello List,
> 
> I have the same problem that Alex Aka in Apr 2006
> http://www.redhat.com/archives/fedora-directory-users/2006-April/msg00022.html
> 
> I have two FDS (fds1 and fds2) in MMR
> 
> in the DNS I create this machines
> 
> fds1     IN     A     10.0.0.11
> fds2     IN     A     10.0.0.12
> fds      IN     A     10.0.0.11
> fds      IN     A     10.0.0.12
> 
> in the clients, I configure the ldap.conf with this parameters:
> 
> BASE            dc=mydomain,dc=com
> URI             ldap://fds.mydomain.com
> 
> this configuration work very,very fine !!!! exist replication between
> servers and fault tolerance in the clients.. but i enable SSL in
> server and in the clients (ldap.conf)
> 
> 
> BASE            dc=mydomain,dc=com
> URI             ldaps://fds.mydomain.com
> TLS_CACERT      /etc/ssl/certs/cacert.org.pem
> TLS_REQCERT     allow
> 
> and "no" work !!! :-( i receive this error:
> 
> ldap_bind: Can't contact LDAP server (-1)
> 
> additional info: TLS: hostname does not match CN in peer certificate
> 
> this problem, is derivate that i configured the servers with one
> certificate and distinct CN for independent serves (fds1 and fds2)...
> 
> if I config one same certificate with same CN (fds) for both nodes
> (fds1 and fds2).. work fine in the clients, but the replication dont
> work !!! :-(
> 
> obs.: my certificates is sign in http://cacert.org
> 
> any idea or suggestion ???
> 
> thanks
> 
> 

-- 
Pochi conoscono cio' che ha veramente scoperto Einstein:
quando mangiamo spaghetti, in effetti stiamo masticando
un concentrato di Spazio-Tempo.
                                    (Antonino Zichichi)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2954 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/fedora-directory-users/attachments/20071003/578df590/attachment.bin>