Fedora directory users - Sep 2007 - question about SSL configuration with IP takeover HA setup

Hey guys,  installed FDS on a couple debian servers this week and am liking it 
so far.  I have a couple questions regarding SSL/TLS setup with servers setup 
for  IP takeover type HA setup.  Keep in mind I have some experience with the 
LDAP side of things,  it''s the ssl and all the different certs and
whatnot
that keeps me up at night.

Essentially what I''m looking at is a 4 way multimaster setup,  ending
up with
2 HA pairs of servers.  call them eastldap and westldap.   I''ve
implemented
the east side in my test lab and have it replicating and can pull any user 
info I need off the directory no problem.

so 
eastldap0.test.com ip 192.168.0.11
eastldap1.test.com ip 192.168.0.12
and the virtual interface on whichever machine is master would be
eastldap.test.com ip 192.168.0.10

and then the exact same setup with the last 2

westldap0.test.com ip 192.168.1.11
westldap1.test.com ip 192.168.1.12
westldap.test.com ip 192.168.1.10

Once everything is setup and running clients would be primarily only  
connecting to either virtual interface west/eastldap using TLS over port 389 
and the 4 masters replicating with encryption (not sure but I imagine this 
takes place on ldaps port).

I followed the instructions on the howto:ssl page and created a cert located 
on eastldap0.  But instead of using the eastldap0.test.com as the cn,  I used 
eastldap.test.com.  Cert installed ok, made sure eastldap0 was the HA master 
and restarted fds.  

When I copied over the cacert to a linux client,  I can run searches using 
ldapsearch -ZZ -h eastldap.test.com.  Server logs and wire sniffs confirm 
everything is coming back encrypted.  It seems to be behaving as expected,  
when I try ldapsearch -ZZ -h eastldap0.test.com,  it pukes with error 11 
additional info: TLS: hostname does not match CN in peer certificate,  which 
is right as the name in the cert is eastldap.test.com.

So it would appear I''m on my way,  I just am not sure about what certs
I need
now, and how to add them properly.  I would think I need at the very least

eastldap0 
- eastldap0.test.com cert
- eastldap.test.com cert
eastldap1
- eastldap1.test.com cert
- eastldap.test.com cert
westldap0
- westldap0.test.com cert
- westldap.test.com cert
westldap1
- westldap1.test.com cert
- westldap.test.com cert

I''m just not sure if that is the proper way to go about it.  Also,  I
would
like to have the clients to be able to have all the cacerts to be able to 
communicate with all virtual and physical address'' if need be.  Later
on,  I
would be adding probably 5 or 6 consumer read only replicas inbetween the 
suppliers and the clients,  but one must walk before they run I guess :)

Long post I know,  just trying to make sure I get all the important stuff out 
there.  Be kind if I was using the incorrect terminology for the 
certs/cacerts :)

Ryan

PS.  anyone have a good SSL for dummies reference that lays out what the heck 
is going on with SSL (pems,keys,certs,cacerts etc)

>
> eastldap0 
> - eastldap0.test.com cert
> - eastldap.test.com cert
> ...
Each running FDS server instance will have just one SSL certificate.
If you want your server to identify with multiple names, you can either:
- Do a cert with subjectAltName extensions.
- Do a cert with a wildcard in the subject''s CN (e.g., cn=*.test.com).

LDAP / SSL client support for these varies, so you will probably want to 
test both ways and see what works with better with your clients.
If it works for you, the subjectAltName method is probably preferable, 
because you can precisely list the valid names for your server.

Also, consider keeping it simple and just doing certs with single names 
(e.g.,  one cert each for ''westldap.test.com'' and
''eastldap.test.com''),
and installing that same cert on each server which should have that SSL 
identity.  This is actually a pretty common way to do it, though it will 
limit your ability to make SSL connections to individual nodenames, like 
eastldap0.test.com (as you noticed).


Ryan Braun wrote:
> Hey guys,  installed FDS on a couple debian servers this week and am liking
it
> so far.  I have a couple questions regarding SSL/TLS setup with servers
setup
> for  IP takeover type HA setup.  Keep in mind I have some experience with
the
> LDAP side of things,  it''s the ssl and all the different certs and
whatnot
> that keeps me up at night.
>
> Essentially what I''m looking at is a 4 way multimaster setup, 
ending up with
> 2 HA pairs of servers.  call them eastldap and westldap.   I''ve
implemented
> the east side in my test lab and have it replicating and can pull any user 
> info I need off the directory no problem.
>
> so 
> eastldap0.test.com ip 192.168.0.11
> eastldap1.test.com ip 192.168.0.12
> and the virtual interface on whichever machine is master would be
> eastldap.test.com ip 192.168.0.10
>
> and then the exact same setup with the last 2
>
> westldap0.test.com ip 192.168.1.11
> westldap1.test.com ip 192.168.1.12
> westldap.test.com ip 192.168.1.10
>
> Once everything is setup and running clients would be primarily only  
> connecting to either virtual interface west/eastldap using TLS over port
389
> and the 4 masters replicating with encryption (not sure but I imagine this 
> takes place on ldaps port).
>
> I followed the instructions on the howto:ssl page and created a cert
located
> on eastldap0.  But instead of using the eastldap0.test.com as the cn,  I
used
> eastldap.test.com.  Cert installed ok, made sure eastldap0 was the HA
master
> and restarted fds.  
>
> When I copied over the cacert to a linux client,  I can run searches using 
> ldapsearch -ZZ -h eastldap.test.com.  Server logs and wire sniffs confirm 
> everything is coming back encrypted.  It seems to be behaving as expected,
> when I try ldapsearch -ZZ -h eastldap0.test.com,  it pukes with error 11 
> additional info: TLS: hostname does not match CN in peer certificate, 
which
> is right as the name in the cert is eastldap.test.com.
>
> So it would appear I''m on my way,  I just am not sure about what
certs I need
> now, and how to add them properly.  I would think I need at the very least
>
> eastldap0 
> - eastldap0.test.com cert
> - eastldap.test.com cert
> eastldap1
> - eastldap1.test.com cert
> - eastldap.test.com cert
> westldap0
> - westldap0.test.com cert
> - westldap.test.com cert
> westldap1
> - westldap1.test.com cert
> - westldap.test.com cert
>
> I''m just not sure if that is the proper way to go about it.  Also,
I would
> like to have the clients to be able to have all the cacerts to be able to 
> communicate with all virtual and physical address'' if need be. 
Later on,  I
> would be adding probably 5 or 6 consumer read only replicas inbetween the 
> suppliers and the clients,  but one must walk before they run I guess :)
>
> Long post I know,  just trying to make sure I get all the important stuff
out
> there.  Be kind if I was using the incorrect terminology for the 
> certs/cacerts :)
>
> Ryan
>
> PS.  anyone have a good SSL for dummies reference that lays out what the
heck
> is going on with SSL (pems,keys,certs,cacerts etc) 
>
> --
>

On Thursday 20 September 2007 21:36, George Holbert wrote:

Ok so I managed to create a new certificate using subjectAltName extenstions,  
and it works as advertised.  I can run ldapsearchs on eastldap on both 
eastldap0.

Now my question is for generating certs for the other servers.  Now that I 
have the CA cert on eastldap0,  I would assume I need to install the CA on 
each additional server.  Can I just copy and paste the cacert.asc into the 
manage certificate wizard?

Then I would generate new certs for each server.  Now do I need to generate 
the certs all from eastldap0?  or once the CA cert is installed on the rest 
of the boxes,  am I able to generate the required certs on each box?  Is it 
generally a good idea to keep all the cert creation in a central location?

And for the clients,  all they need is the one cacert.asc to be able to 
encrypt comms with each server?

Thanks

Ryan

>
> Each running FDS server instance will have just one SSL certificate.
> If you want your server to identify with multiple names, you can either:
> - Do a cert with subjectAltName extensions.
> - Do a cert with a wildcard in the subject''s CN (e.g.,
cn=*.test.com).
>
> LDAP / SSL client support for these varies, so you will probably want to
> test both ways and see what works with better with your clients.
> If it works for you, the subjectAltName method is probably preferable,
> because you can precisely list the valid names for your server.
>
> Also, consider keeping it simple and just doing certs with single names
> (e.g.,  one cert each for ''westldap.test.com'' and
''eastldap.test.com''),
> and installing that same cert on each server which should have that SSL
> identity.  This is actually a pretty common way to do it, though it will
> limit your ability to make SSL connections to individual nodenames, like
> eastldap0.test.com (as you noticed).
>
> Ryan Braun wrote:
> > Hey guys,  installed FDS on a couple debian servers this week and am
> > liking it so far.  I have a couple questions regarding SSL/TLS setup
with
> > servers setup for  IP takeover type HA setup.  Keep in mind I have
some
> > experience with the LDAP side of things,  it''s the ssl and
all the
> > different certs and whatnot that keeps me up at night.
> >
> > Essentially what I''m looking at is a 4 way multimaster setup,
ending up
> > with 2 HA pairs of servers.  call them eastldap and westldap.  
I''ve
> > implemented the east side in my test lab and have it replicating and
can
> > pull any user info I need off the directory no problem.
> >
> > so
> > eastldap0.test.com ip 192.168.0.11
> > eastldap1.test.com ip 192.168.0.12
> > and the virtual interface on whichever machine is master would be
> > eastldap.test.com ip 192.168.0.10
> >
> > and then the exact same setup with the last 2
> >
> > westldap0.test.com ip 192.168.1.11
> > westldap1.test.com ip 192.168.1.12
> > westldap.test.com ip 192.168.1.10
> >
> > Once everything is setup and running clients would be primarily only
> > connecting to either virtual interface west/eastldap using TLS over
port
> > 389 and the 4 masters replicating with encryption (not sure but I
imagine
> > this takes place on ldaps port).
> >
> > I followed the instructions on the howto:ssl page and created a cert
> > located on eastldap0.  But instead of using the eastldap0.test.com as
the
> > cn,  I used eastldap.test.com.  Cert installed ok, made sure eastldap0
> > was the HA master and restarted fds.
> >
> > When I copied over the cacert to a linux client,  I can run searches
> > using ldapsearch -ZZ -h eastldap.test.com.  Server logs and wire
sniffs
> > confirm everything is coming back encrypted.  It seems to be behaving
as
> > expected, when I try ldapsearch -ZZ -h eastldap0.test.com,  it pukes
with
> > error 11 additional info: TLS: hostname does not match CN in peer
> > certificate,  which is right as the name in the cert is
> > eastldap.test.com.
> >
> > So it would appear I''m on my way,  I just am not sure about
what certs I
> > need now, and how to add them properly.  I would think I need at the
very
> > least
> >
> > eastldap0
> > - eastldap0.test.com cert
> > - eastldap.test.com cert
> > eastldap1
> > - eastldap1.test.com cert
> > - eastldap.test.com cert
> > westldap0
> > - westldap0.test.com cert
> > - westldap.test.com cert
> > westldap1
> > - westldap1.test.com cert
> > - westldap.test.com cert
> >
> > I''m just not sure if that is the proper way to go about it. 
Also,  I
> > would like to have the clients to be able to have all the cacerts to
be
> > able to communicate with all virtual and physical address'' if
need be.
> > Later on,  I would be adding probably 5 or 6 consumer read only
replicas
> > inbetween the suppliers and the clients,  but one must walk before
they
> > run I guess :)
> >
> > Long post I know,  just trying to make sure I get all the important
stuff
> > out there.  Be kind if I was using the incorrect terminology for the
> > certs/cacerts :)
> >
> > Ryan
> >
> > PS.  anyone have a good SSL for dummies reference that lays out what
the
> > heck is going on with SSL (pems,keys,certs,cacerts etc)
> >
> > --
>
> --
> Fedora-directory-users mailing list
> Fedora-directory-users@redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users

Ryan Braun wrote:
> On Thursday 20 September 2007 21:36, George Holbert wrote:
>
> Ok so I managed to create a new certificate using subjectAltName
extenstions,
> and it works as advertised.  I can run ldapsearchs on eastldap on both 
> eastldap0.
>
> Now my question is for generating certs for the other servers.  Now that I 
> have the CA cert on eastldap0,  I would assume I need to install the CA on 
> each additional server.  Can I just copy and paste the cacert.asc into the 
> manage certificate wizard?
>   
You cannot use the CA cert to generate server certs.  You need the CA 
cert and key.  This CA key was created when you created your initial CA 
cert.  The CA key is stored in the key3.db in which you initially 
created in steps 5 and 6 here - 
http://directory.fedoraproject.org/wiki/Howto:SSL#Basic_Steps

I would suggest you create all of your server certs using this initial 
CA cert and key.
cd /opt/fedora-ds/alias
serialnumber=1002
for server in serverFQDN ; do
  ../shared/bin/certutil -d . -S -n "Server-Cert-$server" -s 
"cn=$server,ou=Fedora Directory Server" -c "CA certificate"
-t "u,u,u"
-m $serialnumber -v 120 -d . -z noise.txt -f pwdfile.txt
  # each cert must have a unique serial number
  serialnumber=`expr $serialnumber + 1`
  # export the new server cert+key
  ../shared/bin/pk12util -d . -o $server.p12 -n "Server-Cert-$server"
-k
pwdfile.txt -w pwdfile.txt
done

For all of the commands listed above, you may have to specify -P 
slapd-instance- if you are not using cert8.db and key3.db.

Then, copy each file $server.p12 to that $server, along with the 
cacert.asc file
Then, on each server:
cd /opt/fedora-ds/alias
../shared/bin/pk12util -d . -P slapd-instance- -i $server.p12 -w 
pwdfile.txt -k pwdfile.txt
# the -w argument is the file containing the password used to encrypt 
the .p12 file
# the -k argument is the file containing the password for the new key 
database
# you may use a different password for -k here - this is the same 
password used
# in your slapd-instance-pin.txt file

../shared/bin/certutil -A -d . -P slapd-instance- -n "CA certificate"
-t "CT,," -a -i cacert.asc

# this imports your CA cert
> Then I would generate new certs for each server.  Now do I need to generate
> the certs all from eastldap0?  or once the CA cert is installed on the rest
> of the boxes,  am I able to generate the required certs on each box?  Is it
> generally a good idea to keep all the cert creation in a central location?
>
> And for the clients,  all they need is the one cacert.asc to be able to 
> encrypt comms with each server?
>   
Yes.
> Thanks
>
> Ryan
>
>
>   
>> Each running FDS server instance will have just one SSL certificate.
>> If you want your server to identify with multiple names, you can
either:
>> - Do a cert with subjectAltName extensions.
>> - Do a cert with a wildcard in the subject''s CN (e.g.,
cn=*.test.com).
>>
>> LDAP / SSL client support for these varies, so you will probably want
to
>> test both ways and see what works with better with your clients.
>> If it works for you, the subjectAltName method is probably preferable,
>> because you can precisely list the valid names for your server.
>>
>> Also, consider keeping it simple and just doing certs with single names
>> (e.g.,  one cert each for ''westldap.test.com'' and
''eastldap.test.com''),
>> and installing that same cert on each server which should have that SSL
>> identity.  This is actually a pretty common way to do it, though it
will
>> limit your ability to make SSL connections to individual nodenames,
like
>> eastldap0.test.com (as you noticed).
>>
>> Ryan Braun wrote:
>>     
>>> Hey guys,  installed FDS on a couple debian servers this week and
am
>>> liking it so far.  I have a couple questions regarding SSL/TLS
setup with
>>> servers setup for  IP takeover type HA setup.  Keep in mind I have
some
>>> experience with the LDAP side of things,  it''s the ssl and
all the
>>> different certs and whatnot that keeps me up at night.
>>>
>>> Essentially what I''m looking at is a 4 way multimaster
setup,  ending up
>>> with 2 HA pairs of servers.  call them eastldap and westldap.  
I''ve
>>> implemented the east side in my test lab and have it replicating
and can
>>> pull any user info I need off the directory no problem.
>>>
>>> so
>>> eastldap0.test.com ip 192.168.0.11
>>> eastldap1.test.com ip 192.168.0.12
>>> and the virtual interface on whichever machine is master would be
>>> eastldap.test.com ip 192.168.0.10
>>>
>>> and then the exact same setup with the last 2
>>>
>>> westldap0.test.com ip 192.168.1.11
>>> westldap1.test.com ip 192.168.1.12
>>> westldap.test.com ip 192.168.1.10
>>>
>>> Once everything is setup and running clients would be primarily
only
>>> connecting to either virtual interface west/eastldap using TLS over
port
>>> 389 and the 4 masters replicating with encryption (not sure but I
imagine
>>> this takes place on ldaps port).
>>>
>>> I followed the instructions on the howto:ssl page and created a
cert
>>> located on eastldap0.  But instead of using the eastldap0.test.com
as the
>>> cn,  I used eastldap.test.com.  Cert installed ok, made sure
eastldap0
>>> was the HA master and restarted fds.
>>>
>>> When I copied over the cacert to a linux client,  I can run
searches
>>> using ldapsearch -ZZ -h eastldap.test.com.  Server logs and wire
sniffs
>>> confirm everything is coming back encrypted.  It seems to be
behaving as
>>> expected, when I try ldapsearch -ZZ -h eastldap0.test.com,  it
pukes with
>>> error 11 additional info: TLS: hostname does not match CN in peer
>>> certificate,  which is right as the name in the cert is
>>> eastldap.test.com.
>>>
>>> So it would appear I''m on my way,  I just am not sure
about what certs I
>>> need now, and how to add them properly.  I would think I need at
the very
>>> least
>>>
>>> eastldap0
>>> - eastldap0.test.com cert
>>> - eastldap.test.com cert
>>> eastldap1
>>> - eastldap1.test.com cert
>>> - eastldap.test.com cert
>>> westldap0
>>> - westldap0.test.com cert
>>> - westldap.test.com cert
>>> westldap1
>>> - westldap1.test.com cert
>>> - westldap.test.com cert
>>>
>>> I''m just not sure if that is the proper way to go about
it.  Also,  I
>>> would like to have the clients to be able to have all the cacerts
to be
>>> able to communicate with all virtual and physical address''
if need be.
>>> Later on,  I would be adding probably 5 or 6 consumer read only
replicas
>>> inbetween the suppliers and the clients,  but one must walk before
they
>>> run I guess :)
>>>
>>> Long post I know,  just trying to make sure I get all the important
stuff
>>> out there.  Be kind if I was using the incorrect terminology for
the
>>> certs/cacerts :)
>>>
>>> Ryan
>>>
>>> PS.  anyone have a good SSL for dummies reference that lays out
what the
>>> heck is going on with SSL (pems,keys,certs,cacerts etc)
>>>
>>> --
>>>       
>> --
>> Fedora-directory-users mailing list
>> Fedora-directory-users@redhat.com
>> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>>     
>
> --
> Fedora-directory-users mailing list
> Fedora-directory-users@redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>

On Friday 21 September 2007 16:37, Richard Megginson
wrote:
> Ryan Braun wrote:
> > On Thursday 20 September 2007 21:36, George Holbert wrote:
> >
> > Ok so I managed to create a new certificate using subjectAltName
> > extenstions, and it works as advertised.  I can run ldapsearchs on
> > eastldap on both eastldap0.
> >
> > Now my question is for generating certs for the other servers.  Now
that
> > I have the CA cert on eastldap0,  I would assume I need to install the
CA
> > on each additional server.  Can I just copy and paste the cacert.asc
into
> > the manage certificate wizard?
>
> You cannot use the CA cert to generate server certs.  You need the CA
> cert and key.  This CA key was created when you created your initial CA
> cert.  The CA key is stored in the key3.db in which you initially
> created in steps 5 and 6 here -
> http://directory.fedoraproject.org/wiki/Howto:SSL#Basic_Steps
>
> I would suggest you create all of your server certs using this initial
> CA cert and key.
> cd /opt/fedora-ds/alias
> serialnumber=1002
> for server in serverFQDN ; do
>   ../shared/bin/certutil -d . -S -n "Server-Cert-$server" -s
> "cn=$server,ou=Fedora Directory Server" -c "CA
certificate" -t "u,u,u"
> -m $serialnumber -v 120 -d . -z noise.txt -f pwdfile.txt
>   # each cert must have a unique serial number
>   serialnumber=`expr $serialnumber + 1`
>   # export the new server cert+key
>   ../shared/bin/pk12util -d . -o $server.p12 -n
"Server-Cert-$server" -k
> pwdfile.txt -w pwdfile.txt
> done
Rather then run the script,  I tried to run it for one example first

eastldap0:/opt/fedora-ds/alias#../shared/bin/certutil -d . -S -n
"Server-Cert-eastldap1" -s "cn=eastldap1.test.com" -c
"CA certificate" -t "u,u,u" -m 2000 -v 120 -8
eastldap.test.com,eastldap,eastldap1 -d . -z noise.txt -f pwdfile.txt
Generating key.  This may take a few moments...
eastldap0:/opt/fedora-ds/alias#../shared/bin/pk12util -d . -o
ywgldap1.isb.ec.gc.ca.p12 -n "Server-Cert-ywgldap1" -k pwdfile.txt -w
pwdfile.txt
pk12util-bin: PKCS12 EXPORT SUCCESSFUL

So at this point I had the .p12 file and the existing cacert.asc created,  and
sent them over to eastldap1.
>
> For all of the commands listed above, you may have to specify -P
> slapd-instance- if you are not using cert8.db and key3.db.
>
> Then, copy each file $server.p12 to that $server, along with the
> cacert.asc file
> Then, on each server:
> cd /opt/fedora-ds/alias
> ../shared/bin/pk12util -d . -P slapd-instance- -i $server.p12 -w
> pwdfile.txt -k pwdfile.txt
> # the -w argument is the file containing the password used to encrypt
> the .p12 file
> # the -k argument is the file containing the password for the new key
> database
> # you may use a different password for -k here - this is the same
> password used
> # in your slapd-instance-pin.txt file
>
> ../shared/bin/certutil -A -d . -P slapd-instance- -n "CA
certificate" -t
> "CT,," -a -i cacert.asc
>
> # this imports your CA cert
Now the importing, 

eastldap1:/opt/fedora-ds/alias# ../shared/bin/pk12util -d . -P slapd-eastldap1-
-i eastldap1.test.com.p12 -w pwdfile-0.txt -k pwdfile.txt
pk12util-bin: PKCS12 IMPORT SUCCESSFUL
ywgldap1:/opt/fedora-ds/alias# ../shared/bin/certutil -A -d . -P
slapd-eastldap1- -n "CA certificate" -t "CT,," -a -i
cacert.asc


Send over enable ssl ldif

ryan@infinity:~/fds-tools$ ldapmodify -x -h eastldap1 -D "cn=directory
manager" -W -f ssl_enable.ldif
Enter LDAP Password:
modifying entry "cn=encryption,cn=config"

modifying entry "cn=config"
ryan@infinity:~/fds-tools$ ldapmodify -x -h eastldap1 -D "cn=directory
manager" -W -f addrsa.ldif
Enter LDAP Password:
adding new entry "cn=RSA,cn=encryption,cn=config"

But when I restart slapd on eastldap1

Enter PIN for Internal (Software) Token:
[21/Sep/2007:17:52:33 +0000] - SSL alert: Security Initialization:
Can''t find certificate (Server-Cert) for family
cn=RSA,cn=encryption,cn=config (Netscape Portable Runtime error -8174 - security
library: bad database.)
[21/Sep/2007:17:52:33 +0000] - SSL alert: Security Initialization: Unable to
retrieve private key for cert Server-Cert of family
cn=RSA,cn=encryption,cn=config (Netscape Portable Runtime error -8174 - security
library: bad database.)
[21/Sep/2007:17:52:33 +0000] - SSL failure: None of the cipher are valid

Did I miss importing a private key from somewhere?  Do I need to use the
cacert.pfx I created in the basic steps?

Thanks 

Ryan

Ryan Braun wrote:
> On Friday 21 September 2007 16:37, Richard Megginson wrote:
>   
>> Ryan Braun wrote:
>>     
>>> On Thursday 20 September 2007 21:36, George Holbert wrote:
>>>
>>> Ok so I managed to create a new certificate using subjectAltName
>>> extenstions, and it works as advertised.  I can run ldapsearchs on
>>> eastldap on both eastldap0.
>>>
>>> Now my question is for generating certs for the other servers.  Now
that
>>> I have the CA cert on eastldap0,  I would assume I need to install
the CA
>>> on each additional server.  Can I just copy and paste the
cacert.asc into
>>> the manage certificate wizard?
>>>       
>> You cannot use the CA cert to generate server certs.  You need the CA
>> cert and key.  This CA key was created when you created your initial CA
>> cert.  The CA key is stored in the key3.db in which you initially
>> created in steps 5 and 6 here -
>> http://directory.fedoraproject.org/wiki/Howto:SSL#Basic_Steps
>>
>> I would suggest you create all of your server certs using this initial
>> CA cert and key.
>> cd /opt/fedora-ds/alias
>> serialnumber=1002
>> for server in serverFQDN ; do
>>   ../shared/bin/certutil -d . -S -n "Server-Cert-$server" -s
>> "cn=$server,ou=Fedora Directory Server" -c "CA
certificate" -t "u,u,u"
>> -m $serialnumber -v 120 -d . -z noise.txt -f pwdfile.txt
>>   # each cert must have a unique serial number
>>   serialnumber=`expr $serialnumber + 1`
>>   # export the new server cert+key
>>   ../shared/bin/pk12util -d . -o $server.p12 -n
"Server-Cert-$server" -k
>> pwdfile.txt -w pwdfile.txt
>> done
>>     
> Rather then run the script,  I tried to run it for one example first
>
> eastldap0:/opt/fedora-ds/alias#../shared/bin/certutil -d . -S -n
"Server-Cert-eastldap1" -s "cn=eastldap1.test.com" -c
"CA certificate" -t "u,u,u" -m 2000 -v 120 -8
eastldap.test.com,eastldap,eastldap1 -d . -z noise.txt -f pwdfile.txt
> Generating key.  This may take a few moments...
> eastldap0:/opt/fedora-ds/alias#../shared/bin/pk12util -d . -o
ywgldap1.isb.ec.gc.ca.p12 -n "Server-Cert-ywgldap1" -k pwdfile.txt -w
pwdfile.txt
> pk12util-bin: PKCS12 EXPORT SUCCESSFUL
>
> So at this point I had the .p12 file and the existing cacert.asc created, 
and sent them over to eastldap1.
>
>   
>> For all of the commands listed above, you may have to specify -P
>> slapd-instance- if you are not using cert8.db and key3.db.
>>
>> Then, copy each file $server.p12 to that $server, along with the
>> cacert.asc file
>> Then, on each server:
>> cd /opt/fedora-ds/alias
>> ../shared/bin/pk12util -d . -P slapd-instance- -i $server.p12 -w
>> pwdfile.txt -k pwdfile.txt
>> # the -w argument is the file containing the password used to encrypt
>> the .p12 file
>> # the -k argument is the file containing the password for the new key
>> database
>> # you may use a different password for -k here - this is the same
>> password used
>> # in your slapd-instance-pin.txt file
>>
>> ../shared/bin/certutil -A -d . -P slapd-instance- -n "CA
certificate" -t
>> "CT,," -a -i cacert.asc
>>
>> # this imports your CA cert
>>     
>
> Now the importing, 
>
> eastldap1:/opt/fedora-ds/alias# ../shared/bin/pk12util -d . -P
slapd-eastldap1- -i eastldap1.test.com.p12 -w pwdfile-0.txt -k pwdfile.txt
> pk12util-bin: PKCS12 IMPORT SUCCESSFUL
> ywgldap1:/opt/fedora-ds/alias# ../shared/bin/certutil -A -d . -P
slapd-eastldap1- -n "CA certificate" -t "CT,," -a -i
cacert.asc
>
>
> Send over enable ssl ldif
>
> ryan@infinity:~/fds-tools$ ldapmodify -x -h eastldap1 -D "cn=directory
manager" -W -f ssl_enable.ldif
> Enter LDAP Password:
> modifying entry "cn=encryption,cn=config"
>
> modifying entry "cn=config"
> ryan@infinity:~/fds-tools$ ldapmodify -x -h eastldap1 -D "cn=directory
manager" -W -f addrsa.ldif
> Enter LDAP Password:
> adding new entry "cn=RSA,cn=encryption,cn=config"
>
> But when I restart slapd on eastldap1
>
> Enter PIN for Internal (Software) Token:
> [21/Sep/2007:17:52:33 +0000] - SSL alert: Security Initialization:
Can''t find certificate (Server-Cert) for family
cn=RSA,cn=encryption,cn=config (Netscape Portable Runtime error -8174 - security
library: bad database.)
> [21/Sep/2007:17:52:33 +0000] - SSL alert: Security Initialization: Unable
to retrieve private key for cert Server-Cert of family
cn=RSA,cn=encryption,cn=config (Netscape Portable Runtime error -8174 - security
library: bad database.)
> [21/Sep/2007:17:52:33 +0000] - SSL failure: None of the cipher are valid
>
> Did I miss importing a private key from somewhere?  Do I need to use the
cacert.pfx I created in the basic steps?
>   
No.  I think the problem is that the name of the server cert in the cert 
db is Server-Cert-$server not Server-Cert.  I thought there was an 
option to pk12util to import it and rename it, but apparently not.  To 
find out what the server cert name is:
cd /opt/fedora-ds/alias
../shared/bin/certutil -L -d . -P slapd-eastldap1-
I''m assuming it will be Server-Cert-$server
Unless someone knows an easy way to rename it, you can just tell slapd 
to use the new name.
stop-slapd
edit dse.ldif - look for Server-Cert and change it to whatever the 
actual name of your server cert is (Server-Cert-$server)
save and start-slapd
> Thanks 
>
> Ryan
>
>
>
> --
> Fedora-directory-users mailing list
> Fedora-directory-users@redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>

On Friday 21 September 2007 18:27, Richard Megginson
wrote:
> > Rather then run the script,  I tried to run it for one example first
> >
> > eastldap0:/opt/fedora-ds/alias#../shared/bin/certutil -d . -S -n
> > "Server-Cert-eastldap1" -s "cn=eastldap1.test.com"
-c "CA certificate" -t
> > "u,u,u" -m 2000 -v 120 -8
eastldap.test.com,eastldap,eastldap1 -d . -z
> > noise.txt -f pwdfile.txt Generating key.  This may take a few
moments...
> > eastldap0:/opt/fedora-ds/alias#../shared/bin/pk12util -d . -o
> > eastldap1.test.com.p12 -n "Server-Cert-eastdap1" -k
pwdfile.txt -w
> > pwdfile.txt pk12util-bin: PKCS12 EXPORT SUCCESSFUL
> >
> > So at this point I had the .p12 file and the existing cacert.asc
created,
> >  and sent them over to eastldap1.
> >
> >> For all of the commands listed above, you may have to specify -P
> >> slapd-instance- if you are not using cert8.db and key3.db.
> >>
> >> Then, copy each file $server.p12 to that $server, along with the
> >> cacert.asc file
> >> Then, on each server:
> >> cd /opt/fedora-ds/alias
> >> ../shared/bin/pk12util -d . -P slapd-instance- -i $server.p12 -w
> >> pwdfile.txt -k pwdfile.txt
> >> # the -w argument is the file containing the password used to
encrypt
> >> the .p12 file
> >> # the -k argument is the file containing the password for the new
key
> >> database
> >> # you may use a different password for -k here - this is the same
> >> password used
> >> # in your slapd-instance-pin.txt file
> >>
> >> ../shared/bin/certutil -A -d . -P slapd-instance- -n "CA
certificate" -t
> >> "CT,," -a -i cacert.asc
> >>
> >> # this imports your CA cert
> >
> > Now the importing,
> >
> > eastldap1:/opt/fedora-ds/alias# ../shared/bin/pk12util -d . -P
> > slapd-eastldap1- -i eastldap1.test.com.p12 -w pwdfile-0.txt -k
> > pwdfile.txt pk12util-bin: PKCS12 IMPORT SUCCESSFUL
> > ywgldap1:/opt/fedora-ds/alias# ../shared/bin/certutil -A -d . -P
> > slapd-eastldap1- -n "CA certificate" -t "CT,," -a
-i cacert.asc
> >
> >
> > Send over enable ssl ldif
> >
> > ryan@infinity:~/fds-tools$ ldapmodify -x -h eastldap1 -D
"cn=directory
> > manager" -W -f ssl_enable.ldif Enter LDAP Password:
> > modifying entry "cn=encryption,cn=config"
> >
> > modifying entry "cn=config"
> > ryan@infinity:~/fds-tools$ ldapmodify -x -h eastldap1 -D
"cn=directory
> > manager" -W -f addrsa.ldif Enter LDAP Password:
> > adding new entry "cn=RSA,cn=encryption,cn=config"
> >
> > But when I restart slapd on eastldap1
> >
> > Enter PIN for Internal (Software) Token:
> > [21/Sep/2007:17:52:33 +0000] - SSL alert: Security Initialization:
Can''t
> > find certificate (Server-Cert) for family
cn=RSA,cn=encryption,cn=config
> > (Netscape Portable Runtime error -8174 - security library: bad
database.)
> > [21/Sep/2007:17:52:33 +0000] - SSL alert: Security Initialization:
Unable
> > to retrieve private key for cert Server-Cert of family
> > cn=RSA,cn=encryption,cn=config (Netscape Portable Runtime error -8174
-
> > security library: bad database.) [21/Sep/2007:17:52:33 +0000] - SSL
> > failure: None of the cipher are valid
> >
> > Did I miss importing a private key from somewhere?  Do I need to use
the
> > cacert.pfx I created in the basic steps?
>
> No.  I think the problem is that the name of the server cert in the cert
> db is Server-Cert-$server not Server-Cert.  I thought there was an
> option to pk12util to import it and rename it, but apparently not.  To
> find out what the server cert name is:
> cd /opt/fedora-ds/alias
> ../shared/bin/certutil -L -d . -P slapd-eastldap1-
> I''m assuming it will be Server-Cert-$server
> Unless someone knows an easy way to rename it, you can just tell slapd
> to use the new name.
> stop-slapd
> edit dse.ldif - look for Server-Cert and change it to whatever the
> actual name of your server cert is (Server-Cert-$server)
> save and start-slapd
>
Thanks for the help!,  the modifying of dse.ldif did the trick and it all 
seems to be working.

Now what in the process would I have to change in order to be able to generate 
the certs with a Server-Cert-$server nickname and have fds recognize the 
proper name,  without having to edit dse.ldif for each box?

Ryan

Ryan Braun wrote:
> On Friday 21 September 2007 18:27, Richard Megginson wrote:
>   
>>> Rather then run the script,  I tried to run it for one example
first
>>>
>>> eastldap0:/opt/fedora-ds/alias#../shared/bin/certutil -d . -S -n
>>> "Server-Cert-eastldap1" -s
"cn=eastldap1.test.com" -c "CA certificate" -t
>>> "u,u,u" -m 2000 -v 120 -8
eastldap.test.com,eastldap,eastldap1 -d . -z
>>> noise.txt -f pwdfile.txt Generating key.  This may take a few
moments...
>>> eastldap0:/opt/fedora-ds/alias#../shared/bin/pk12util -d . -o
>>> eastldap1.test.com.p12 -n "Server-Cert-eastdap1" -k
pwdfile.txt -w
>>> pwdfile.txt pk12util-bin: PKCS12 EXPORT SUCCESSFUL
>>>
>>> So at this point I had the .p12 file and the existing cacert.asc
created,
>>>  and sent them over to eastldap1.
>>>
>>>       
>>>> For all of the commands listed above, you may have to specify
-P
>>>> slapd-instance- if you are not using cert8.db and key3.db.
>>>>
>>>> Then, copy each file $server.p12 to that $server, along with
the
>>>> cacert.asc file
>>>> Then, on each server:
>>>> cd /opt/fedora-ds/alias
>>>> ../shared/bin/pk12util -d . -P slapd-instance- -i $server.p12
-w
>>>> pwdfile.txt -k pwdfile.txt
>>>> # the -w argument is the file containing the password used to
encrypt
>>>> the .p12 file
>>>> # the -k argument is the file containing the password for the
new key
>>>> database
>>>> # you may use a different password for -k here - this is the
same
>>>> password used
>>>> # in your slapd-instance-pin.txt file
>>>>
>>>> ../shared/bin/certutil -A -d . -P slapd-instance- -n "CA
certificate" -t
>>>> "CT,," -a -i cacert.asc
>>>>
>>>> # this imports your CA cert
>>>>         
>>> Now the importing,
>>>
>>> eastldap1:/opt/fedora-ds/alias# ../shared/bin/pk12util -d . -P
>>> slapd-eastldap1- -i eastldap1.test.com.p12 -w pwdfile-0.txt -k
>>> pwdfile.txt pk12util-bin: PKCS12 IMPORT SUCCESSFUL
>>> ywgldap1:/opt/fedora-ds/alias# ../shared/bin/certutil -A -d . -P
>>> slapd-eastldap1- -n "CA certificate" -t "CT,,"
-a -i cacert.asc
>>>
>>>
>>> Send over enable ssl ldif
>>>
>>> ryan@infinity:~/fds-tools$ ldapmodify -x -h eastldap1 -D
"cn=directory
>>> manager" -W -f ssl_enable.ldif Enter LDAP Password:
>>> modifying entry "cn=encryption,cn=config"
>>>
>>> modifying entry "cn=config"
>>> ryan@infinity:~/fds-tools$ ldapmodify -x -h eastldap1 -D
"cn=directory
>>> manager" -W -f addrsa.ldif Enter LDAP Password:
>>> adding new entry "cn=RSA,cn=encryption,cn=config"
>>>
>>> But when I restart slapd on eastldap1
>>>
>>> Enter PIN for Internal (Software) Token:
>>> [21/Sep/2007:17:52:33 +0000] - SSL alert: Security Initialization:
Can''t
>>> find certificate (Server-Cert) for family
cn=RSA,cn=encryption,cn=config
>>> (Netscape Portable Runtime error -8174 - security library: bad
database.)
>>> [21/Sep/2007:17:52:33 +0000] - SSL alert: Security Initialization:
Unable
>>> to retrieve private key for cert Server-Cert of family
>>> cn=RSA,cn=encryption,cn=config (Netscape Portable Runtime error
-8174 -
>>> security library: bad database.) [21/Sep/2007:17:52:33 +0000] - SSL
>>> failure: None of the cipher are valid
>>>
>>> Did I miss importing a private key from somewhere?  Do I need to
use the
>>> cacert.pfx I created in the basic steps?
>>>       
>> No.  I think the problem is that the name of the server cert in the
cert
>> db is Server-Cert-$server not Server-Cert.  I thought there was an
>> option to pk12util to import it and rename it, but apparently not.  To
>> find out what the server cert name is:
>> cd /opt/fedora-ds/alias
>> ../shared/bin/certutil -L -d . -P slapd-eastldap1-
>> I''m assuming it will be Server-Cert-$server
>> Unless someone knows an easy way to rename it, you can just tell slapd
>> to use the new name.
>> stop-slapd
>> edit dse.ldif - look for Server-Cert and change it to whatever the
>> actual name of your server cert is (Server-Cert-$server)
>> save and start-slapd
>>
>>     
>
> Thanks for the help!,  the modifying of dse.ldif did the trick and it all 
> seems to be working.
>
> Now what in the process would I have to change in order to be able to
generate
> the certs with a Server-Cert-$server nickname and have fds recognize the 
> proper name,  without having to edit dse.ldif for each box?
>   
I''m not sure.  There''s probably a way to use pk12util to
export/import a
cert with a different name, or use certutil to change the name, but I 
just don''t know.
> Ryan
>
> --
> Fedora-directory-users mailing list
> Fedora-directory-users@redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>