[Fedora-directory-users] problem with SSL and load balance

[Jazcek Braden]

Wildcard certs definitely work, that is the way that I have my load 
balanced installation setup.  However if you are trying to use 
self-signed certificates I think you have to make sure to setup the 
trust chain, but I am not sure.

-- 
Jazcek Braden


Richard Hesse wrote:
> Do wildcard certs work with Fedora Directory Server? If they do, that will easily solve your problem. That or setting checkpeer to off.
>
> -richard
>
> -----Original Message-----
> From: fedora-directory-users-bounces at redhat.com [mailto:fedora-directory-users-bounces at redhat.com] On Behalf Of Victor Hugo dos Santos
> Sent: Wednesday, October 03, 2007 8:20 AM
> To: General discussion list for the Fedora Directory server project.
> Subject: [Fedora-directory-users] problem with SSL and load balance
>
> Hello List,
>
> I have the same problem that Alex Aka in Apr 2006
> http://www.redhat.com/archives/fedora-directory-users/2006-April/msg00022.html
>
> I have two FDS (fds1 and fds2) in MMR
>
> in the DNS I create this machines
>
> fds1     IN     A     10.0.0.11
> fds2     IN     A     10.0.0.12
> fds      IN     A     10.0.0.11
> fds      IN     A     10.0.0.12
>
> in the clients, I configure the ldap.conf with this parameters:
>
> BASE            dc=mydomain,dc=com
> URI             ldap://fds.mydomain.com
>
> this configuration work very,very fine !!!! exist replication between
> servers and fault tolerance in the clients.. but i enable SSL in
> server and in the clients (ldap.conf)
>
>
> BASE            dc=mydomain,dc=com
> URI             ldaps://fds.mydomain.com
> TLS_CACERT      /etc/ssl/certs/cacert.org.pem
> TLS_REQCERT     allow
>
> and "no" work !!! :-( i receive this error:
>
> ldap_bind: Can't contact LDAP server (-1)
>
> additional info: TLS: hostname does not match CN in peer certificate
>
> this problem, is derivate that i configured the servers with one
> certificate and distinct CN for independent serves (fds1 and fds2)...
>
> if I config one same certificate with same CN (fds) for both nodes
> (fds1 and fds2).. work fine in the clients, but the replication dont
> work !!! :-(
>
> obs.: my certificates is sign in http://cacert.org
>
> any idea or suggestion ???
>
> thanks
>
>
> --
> --
> Victor Hugo dos Santos
> Linux Counter #224399
>
> --
> Fedora-directory-users mailing list
> Fedora-directory-users at redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>
> --
> Fedora-directory-users mailing list
> Fedora-directory-users at redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>
>   




-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.