thr3ads.net - samba - [Samba] Problem with intermediate certificate (tls cafile) [Aug 2020]

If this information is useful, please help other people find it:
Share via:

MAS Jean-Louis

2020-Aug-04 13:18 UTC

[Samba] Problem with intermediate certificate (tls cafile)

I have several samba servers on Debian 10 all using :

samba          2:4.9.5+dfsg-5+deb10u1 amd64

I use tls cafile, tls certfile and tls keyfile with certificates from
Sectigo (https://cert-manager.com)

And when checking my connexion from the samba server, or from outside,
I've got "unable to verify the first certificate" even if
tls_cafile is
provided in smb.conf.

What is wrong ?

# checking my connexion

openssl s_client -showcerts -connect localhost:636

CONNECTED(00000003)
Can't use SSL_get_servername
depth=0 C = FR, postalCode = 00000, ST = XXX, L = XXX, O = XXX, OU XXX, CN =
ad-rep2.example.com
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 C = FR, postalCode = 00000, ST = XXX, L = XXX, O = XXX, OU XXX, CN =
ad-rep2.example.com
verify error:num=21:unable to verify the first certificate
verify return:1
...
Server certificate
subject=C = FR, postalCode = 00000, ST = XXX, L = XXX, O = XXX, OU =XXX,
CN = ad-rep2.example.com

issuer=C = NL, O = GEANT Vereniging, CN = GEANT OV RSA CA 4

---
Acceptable client certificate CA names
C = NL, O = GEANT Vereniging, CN = GEANT OV RSA CA 4
C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN
= USERTrust RSA Certification Authority
C = GB, ST = Greater Manchester, L = Salford, O = Comodo CA Limited, CN
= AAA Certificate Services
Requested Signature Algorithms:
RSA+SHA256:RSA-PSS+SHA256:RSA-PSS+SHA256:ECDSA+SHA256:Ed25519:RSA+SHA384:RSA-PSS+SHA384:RSA-PSS+SHA384:ECDSA+SHA384:RSA+SHA512:RSA-PSS+SHA512:RSA-PSS+SHA512:ECDSA+SHA512:RSA+SHA1:ECDSA+SHA1
Shared Requested Signature Algorithms:
RSA+SHA256:RSA-PSS+SHA256:RSA-PSS+SHA256:ECDSA+SHA256:Ed25519:RSA+SHA384:RSA-PSS+SHA384:RSA-PSS+SHA384:ECDSA+SHA384:RSA+SHA512:RSA-PSS+SHA512:RSA-PSS+SHA512:ECDSA+SHA512
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 3041 bytes and written 393 bytes
Verification error: unable to verify the first certificate
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 21 (unable to verify the first certificate)

# checking my connexion with intermediate certificate

openssl s_client -showcerts -connect localhost:636 -CAfile
/etc/ssl/certs/ad-rep2.example.com-2020-intermediate.pem

CONNECTED(00000003)
Can't use SSL_get_servername
depth=3 C = GB, ST = Greater Manchester, L = Salford, O = Comodo CA
Limited, CN = AAA Certificate Services
verify return:1
depth=2 C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST
Network, CN = USERTrust RSA Certification Authority
verify return:1
depth=1 C = NL, O = GEANT Vereniging, CN = GEANT OV RSA CA 4
verify return:1
depth=0 C = FR, postalCode = 00000, ST = XXX, L = XXX, O = XXX, OU =XXX,
CN = ad-rep2.example.com
verify return:1
---
Certificate chain
 0 s:C = FR, postalCode = 00000, ST = XXX, L = XXX, O = XXX, OU =XXX, CN
= ad-rep2.example.com
   i:C = NL, O = GEANT Vereniging, CN = GEANT OV RSA CA 4
---
Server certificate
subject=C = FR, postalCode = 00000, ST = XXX, L = XXX, O = XXX, OU =XXX,
CN = ad-rep2.example.com

issuer=C = NL, O = GEANT Vereniging, CN = GEANT OV RSA CA 4

---
Acceptable client certificate CA names
C = NL, O = GEANT Vereniging, CN = GEANT OV RSA CA 4
C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN
= USERTrust RSA Certification Authority
C = GB, ST = Greater Manchester, L = Salford, O = Comodo CA Limited, CN
= AAA Certificate Services
Requested Signature Algorithms:
RSA+SHA256:RSA-PSS+SHA256:RSA-PSS+SHA256:ECDSA+SHA256:Ed25519:RSA+SHA384:RSA-PSS+SHA384:RSA-PSS+SHA384:ECDSA+SHA384:RSA+SHA512:RSA-PSS+SHA512:RSA-PSS+SHA512:ECDSA+SHA512:RSA+SHA1:ECDSA+SHA1
Shared Requested Signature Algorithms:
RSA+SHA256:RSA-PSS+SHA256:RSA-PSS+SHA256:ECDSA+SHA256:Ed25519:RSA+SHA384:RSA-PSS+SHA384:RSA-PSS+SHA384:ECDSA+SHA384:RSA+SHA512:RSA-PSS+SHA512:RSA-PSS+SHA512:ECDSA+SHA512
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 3041 bytes and written 393 bytes
Verification: OK
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
closed

# My smb.conf

[global]
        allow dns updates = nonsecure and secure
        disable spoolss = Yes
        dns forwarder = w.x.y.z a.b.c.d
        load printers = No
        log file = /var/log/samba/samba-ad.log
        netbios name = AD-REP2
        passdb backend = samba_dsdb
        printcap cache time = 0
        printcap name = /dev/null
        realm = EXAMPLE.COM
        server role = active directory domain controller
        server string = Samba Server Version %v
        template homedir = /home/%ACCOUNTNAME%
        template shell = /bin/bash
        tls cafile = tls/ad-rep2.example.com-2020-intermediate.pem
        tls certfile = tls/ad-rep2.example.com-2020-certonly.pem
        tls keyfile = tls/ad-rep2.example.com-2020.key
        tls verify peer = ca_and_name
        workgroup = EXAMPLE
        winbindd:use external pipes = true
        smbd:backgroundqueue = no
        rpc_daemon:spoolssd = embedded
        rpc_server:tcpip = no
        rpc_server:spoolss = embedded
        rpc_server:winreg = embedded
        rpc_server:ntsvcs = embedded
        rpc_server:eventlog = embedded
        rpc_server:srvsvc = embedded
        rpc_server:svcctl = embedded
        rpc_server:default = external
        idmap_ldb:use rfc2307 = yes
        idmap config * : backend = tdb
        lpq command = lpq -P'%p'
        lprm command = lprm -P'%p' %j
        map archive = No
        print command = lpr -r -P'%p' %s
        printing = bsd

Intermediate certificates
(tls/ad-rep2.example.com-2020-intermediate.pem) are ordered as mentioned
in sectigo's documentation :

"SSLCertificateChainFile: Intermediate(s)/Root only,  PEM encoded (it
contains the certificates from the leaf, without the certificate itself,
to the root)"

Thanks

-- 
Jean Louis Mas

MAS Jean-Louis

2020-Aug-06 15:36 UTC

head link

[Samba] Problem with intermediate certificate (tls cafile)

Nobody has any clues about the tls cafile ?

Regards

Le 04/08/2020 ? 15:18, MAS Jean-Louis via samba a
?crit?:> I have several samba servers on Debian 10 all using :
> 
> samba          2:4.9.5+dfsg-5+deb10u1 amd64
> 
> I use tls cafile, tls certfile and tls keyfile with certificates from
> Sectigo (https://cert-manager.com)
> 
> And when checking my connexion from the samba server, or from outside,
> I've got "unable to verify the first certificate" even if
tls_cafile is
> provided in smb.conf.
> 
> What is wrong ?
> 
> # checking my connexion
> 
> openssl s_client -showcerts -connect localhost:636
> 
> CONNECTED(00000003)
> Can't use SSL_get_servername
> depth=0 C = FR, postalCode = 00000, ST = XXX, L = XXX, O = XXX, OU >
XXX, CN = ad-rep2.example.com
> verify error:num=20:unable to get local issuer certificate
> verify return:1
> depth=0 C = FR, postalCode = 00000, ST = XXX, L = XXX, O = XXX, OU >
XXX, CN = ad-rep2.example.com
> verify error:num=21:unable to verify the first certificate
> verify return:1
> ...
> Server certificate
> subject=C = FR, postalCode = 00000, ST = XXX, L = XXX, O = XXX, OU =XXX,
> CN = ad-rep2.example.com
> 
> issuer=C = NL, O = GEANT Vereniging, CN = GEANT OV RSA CA 4
> 
> ---
> Acceptable client certificate CA names
> C = NL, O = GEANT Vereniging, CN = GEANT OV RSA CA 4
> C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN
> = USERTrust RSA Certification Authority
> C = GB, ST = Greater Manchester, L = Salford, O = Comodo CA Limited, CN
> = AAA Certificate Services
> Requested Signature Algorithms:
>
RSA+SHA256:RSA-PSS+SHA256:RSA-PSS+SHA256:ECDSA+SHA256:Ed25519:RSA+SHA384:RSA-PSS+SHA384:RSA-PSS+SHA384:ECDSA+SHA384:RSA+SHA512:RSA-PSS+SHA512:RSA-PSS+SHA512:ECDSA+SHA512:RSA+SHA1:ECDSA+SHA1
> Shared Requested Signature Algorithms:
>
RSA+SHA256:RSA-PSS+SHA256:RSA-PSS+SHA256:ECDSA+SHA256:Ed25519:RSA+SHA384:RSA-PSS+SHA384:RSA-PSS+SHA384:ECDSA+SHA384:RSA+SHA512:RSA-PSS+SHA512:RSA-PSS+SHA512:ECDSA+SHA512
> Peer signing digest: SHA256
> Peer signature type: RSA-PSS
> Server Temp Key: X25519, 253 bits
> ---
> SSL handshake has read 3041 bytes and written 393 bytes
> Verification error: unable to verify the first certificate
> ---
> New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
> Server public key is 2048 bit
> Secure Renegotiation IS NOT supported
> Compression: NONE
> Expansion: NONE
> No ALPN negotiated
> Early data was not sent
> Verify return code: 21 (unable to verify the first certificate)
> 
> # checking my connexion with intermediate certificate
> 
> openssl s_client -showcerts -connect localhost:636 -CAfile
> /etc/ssl/certs/ad-rep2.example.com-2020-intermediate.pem
> 
> CONNECTED(00000003)
> Can't use SSL_get_servername
> depth=3 C = GB, ST = Greater Manchester, L = Salford, O = Comodo CA
> Limited, CN = AAA Certificate Services
> verify return:1
> depth=2 C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST
> Network, CN = USERTrust RSA Certification Authority
> verify return:1
> depth=1 C = NL, O = GEANT Vereniging, CN = GEANT OV RSA CA 4
> verify return:1
> depth=0 C = FR, postalCode = 00000, ST = XXX, L = XXX, O = XXX, OU =XXX,
> CN = ad-rep2.example.com
> verify return:1
> ---
> Certificate chain
>  0 s:C = FR, postalCode = 00000, ST = XXX, L = XXX, O = XXX, OU =XXX, CN
> = ad-rep2.example.com
>    i:C = NL, O = GEANT Vereniging, CN = GEANT OV RSA CA 4
> ---
> Server certificate
> subject=C = FR, postalCode = 00000, ST = XXX, L = XXX, O = XXX, OU =XXX,
> CN = ad-rep2.example.com
> 
> issuer=C = NL, O = GEANT Vereniging, CN = GEANT OV RSA CA 4
> 
> ---
> Acceptable client certificate CA names
> C = NL, O = GEANT Vereniging, CN = GEANT OV RSA CA 4
> C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN
> = USERTrust RSA Certification Authority
> C = GB, ST = Greater Manchester, L = Salford, O = Comodo CA Limited, CN
> = AAA Certificate Services
> Requested Signature Algorithms:
>
RSA+SHA256:RSA-PSS+SHA256:RSA-PSS+SHA256:ECDSA+SHA256:Ed25519:RSA+SHA384:RSA-PSS+SHA384:RSA-PSS+SHA384:ECDSA+SHA384:RSA+SHA512:RSA-PSS+SHA512:RSA-PSS+SHA512:ECDSA+SHA512:RSA+SHA1:ECDSA+SHA1
> Shared Requested Signature Algorithms:
>
RSA+SHA256:RSA-PSS+SHA256:RSA-PSS+SHA256:ECDSA+SHA256:Ed25519:RSA+SHA384:RSA-PSS+SHA384:RSA-PSS+SHA384:ECDSA+SHA384:RSA+SHA512:RSA-PSS+SHA512:RSA-PSS+SHA512:ECDSA+SHA512
> Peer signing digest: SHA256
> Peer signature type: RSA-PSS
> Server Temp Key: X25519, 253 bits
> ---
> SSL handshake has read 3041 bytes and written 393 bytes
> Verification: OK
> ---
> New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
> Server public key is 2048 bit
> Secure Renegotiation IS NOT supported
> Compression: NONE
> Expansion: NONE
> No ALPN negotiated
> Early data was not sent
> Verify return code: 0 (ok)
> ---
> closed
> 
> # My smb.conf
> 
> [global]
>         allow dns updates = nonsecure and secure
>         disable spoolss = Yes
>         dns forwarder = w.x.y.z a.b.c.d
>         load printers = No
>         log file = /var/log/samba/samba-ad.log
>         netbios name = AD-REP2
>         passdb backend = samba_dsdb
>         printcap cache time = 0
>         printcap name = /dev/null
>         realm = EXAMPLE.COM
>         server role = active directory domain controller
>         server string = Samba Server Version %v
>         template homedir = /home/%ACCOUNTNAME%
>         template shell = /bin/bash
>         tls cafile = tls/ad-rep2.example.com-2020-intermediate.pem
>         tls certfile = tls/ad-rep2.example.com-2020-certonly.pem
>         tls keyfile = tls/ad-rep2.example.com-2020.key
>         tls verify peer = ca_and_name
>         workgroup = EXAMPLE
>         winbindd:use external pipes = true
>         smbd:backgroundqueue = no
>         rpc_daemon:spoolssd = embedded
>         rpc_server:tcpip = no
>         rpc_server:spoolss = embedded
>         rpc_server:winreg = embedded
>         rpc_server:ntsvcs = embedded
>         rpc_server:eventlog = embedded
>         rpc_server:srvsvc = embedded
>         rpc_server:svcctl = embedded
>         rpc_server:default = external
>         idmap_ldb:use rfc2307 = yes
>         idmap config * : backend = tdb
>         lpq command = lpq -P'%p'
>         lprm command = lprm -P'%p' %j
>         map archive = No
>         print command = lpr -r -P'%p' %s
>         printing = bsd
> 
> Intermediate certificates
> (tls/ad-rep2.example.com-2020-intermediate.pem) are ordered as mentioned
> in sectigo's documentation :
> 
> "SSLCertificateChainFile: Intermediate(s)/Root only,  PEM encoded (it
> contains the certificates from the leaf, without the certificate itself,
> to the root)"
> 
> Thanks
> 
-- 
Jean Louis Mas
?quipe MI LIG
Tel: 04 57 421 425
chat : https://tchat.univ-grenoble-alpes.fr/direct/masjea

Nick Howitt

2020-Aug-06 15:43 UTC

head link

[Samba] Problem with intermediate certificate (tls cafile)

If I were guessing, based on some experience with certificate usage in 
other apps, concatenate your certificate and intermediate certificates 
into a single file which is then your "tls certfile" then point
"tls
cafile" to your issuers proper CA or just to your distro's CA bundle, 
e.g /etc/pki/tls/certs/ca-bundle.crt.

Nick

On 06/08/2020 16:36, MAS Jean-Louis via samba wrote:> Nobody has any clues about the tls cafile ?
>
> Regards
>
> Le 04/08/2020 ? 15:18, MAS Jean-Louis via samba a ?crit?:
>> I have several samba servers on Debian 10 all using :
>>
>> samba          2:4.9.5+dfsg-5+deb10u1 amd64
>>
>> I use tls cafile, tls certfile and tls keyfile with certificates from
>> Sectigo (https://cert-manager.com)
>>
>> And when checking my connexion from the samba server, or from outside,
>> I've got "unable to verify the first certificate" even if
tls_cafile is
>> provided in smb.conf.
>>
>> What is wrong ?
>>
>> # checking my connexion
>>
>> openssl s_client -showcerts -connect localhost:636
>>
>> CONNECTED(00000003)
>> Can't use SSL_get_servername
>> depth=0 C = FR, postalCode = 00000, ST = XXX, L = XXX, O = XXX, OU
>> XXX, CN = ad-rep2.example.com
>> verify error:num=20:unable to get local issuer certificate
>> verify return:1
>> depth=0 C = FR, postalCode = 00000, ST = XXX, L = XXX, O = XXX, OU
>> XXX, CN = ad-rep2.example.com
>> verify error:num=21:unable to verify the first certificate
>> verify return:1
>> ...
>> Server certificate
>> subject=C = FR, postalCode = 00000, ST = XXX, L = XXX, O = XXX, OU
=XXX,
>> CN = ad-rep2.example.com
>>
>> issuer=C = NL, O = GEANT Vereniging, CN = GEANT OV RSA CA 4
>>
>> ---
>> Acceptable client certificate CA names
>> C = NL, O = GEANT Vereniging, CN = GEANT OV RSA CA 4
>> C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN
>> = USERTrust RSA Certification Authority
>> C = GB, ST = Greater Manchester, L = Salford, O = Comodo CA Limited, CN
>> = AAA Certificate Services
>> Requested Signature Algorithms:
>>
RSA+SHA256:RSA-PSS+SHA256:RSA-PSS+SHA256:ECDSA+SHA256:Ed25519:RSA+SHA384:RSA-PSS+SHA384:RSA-PSS+SHA384:ECDSA+SHA384:RSA+SHA512:RSA-PSS+SHA512:RSA-PSS+SHA512:ECDSA+SHA512:RSA+SHA1:ECDSA+SHA1
>> Shared Requested Signature Algorithms:
>>
RSA+SHA256:RSA-PSS+SHA256:RSA-PSS+SHA256:ECDSA+SHA256:Ed25519:RSA+SHA384:RSA-PSS+SHA384:RSA-PSS+SHA384:ECDSA+SHA384:RSA+SHA512:RSA-PSS+SHA512:RSA-PSS+SHA512:ECDSA+SHA512
>> Peer signing digest: SHA256
>> Peer signature type: RSA-PSS
>> Server Temp Key: X25519, 253 bits
>> ---
>> SSL handshake has read 3041 bytes and written 393 bytes
>> Verification error: unable to verify the first certificate
>> ---
>> New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
>> Server public key is 2048 bit
>> Secure Renegotiation IS NOT supported
>> Compression: NONE
>> Expansion: NONE
>> No ALPN negotiated
>> Early data was not sent
>> Verify return code: 21 (unable to verify the first certificate)
>>
>> # checking my connexion with intermediate certificate
>>
>> openssl s_client -showcerts -connect localhost:636 -CAfile
>> /etc/ssl/certs/ad-rep2.example.com-2020-intermediate.pem
>>
>> CONNECTED(00000003)
>> Can't use SSL_get_servername
>> depth=3 C = GB, ST = Greater Manchester, L = Salford, O = Comodo CA
>> Limited, CN = AAA Certificate Services
>> verify return:1
>> depth=2 C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST
>> Network, CN = USERTrust RSA Certification Authority
>> verify return:1
>> depth=1 C = NL, O = GEANT Vereniging, CN = GEANT OV RSA CA 4
>> verify return:1
>> depth=0 C = FR, postalCode = 00000, ST = XXX, L = XXX, O = XXX, OU
=XXX,
>> CN = ad-rep2.example.com
>> verify return:1
>> ---
>> Certificate chain
>>   0 s:C = FR, postalCode = 00000, ST = XXX, L = XXX, O = XXX, OU =XXX,
CN
>> = ad-rep2.example.com
>>     i:C = NL, O = GEANT Vereniging, CN = GEANT OV RSA CA 4
>> ---
>> Server certificate
>> subject=C = FR, postalCode = 00000, ST = XXX, L = XXX, O = XXX, OU
=XXX,
>> CN = ad-rep2.example.com
>>
>> issuer=C = NL, O = GEANT Vereniging, CN = GEANT OV RSA CA 4
>>
>> ---
>> Acceptable client certificate CA names
>> C = NL, O = GEANT Vereniging, CN = GEANT OV RSA CA 4
>> C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN
>> = USERTrust RSA Certification Authority
>> C = GB, ST = Greater Manchester, L = Salford, O = Comodo CA Limited, CN
>> = AAA Certificate Services
>> Requested Signature Algorithms:
>>
RSA+SHA256:RSA-PSS+SHA256:RSA-PSS+SHA256:ECDSA+SHA256:Ed25519:RSA+SHA384:RSA-PSS+SHA384:RSA-PSS+SHA384:ECDSA+SHA384:RSA+SHA512:RSA-PSS+SHA512:RSA-PSS+SHA512:ECDSA+SHA512:RSA+SHA1:ECDSA+SHA1
>> Shared Requested Signature Algorithms:
>>
RSA+SHA256:RSA-PSS+SHA256:RSA-PSS+SHA256:ECDSA+SHA256:Ed25519:RSA+SHA384:RSA-PSS+SHA384:RSA-PSS+SHA384:ECDSA+SHA384:RSA+SHA512:RSA-PSS+SHA512:RSA-PSS+SHA512:ECDSA+SHA512
>> Peer signing digest: SHA256
>> Peer signature type: RSA-PSS
>> Server Temp Key: X25519, 253 bits
>> ---
>> SSL handshake has read 3041 bytes and written 393 bytes
>> Verification: OK
>> ---
>> New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
>> Server public key is 2048 bit
>> Secure Renegotiation IS NOT supported
>> Compression: NONE
>> Expansion: NONE
>> No ALPN negotiated
>> Early data was not sent
>> Verify return code: 0 (ok)
>> ---
>> closed
>>
>> # My smb.conf
>>
>> [global]
>>          allow dns updates = nonsecure and secure
>>          disable spoolss = Yes
>>          dns forwarder = w.x.y.z a.b.c.d
>>          load printers = No
>>          log file = /var/log/samba/samba-ad.log
>>          netbios name = AD-REP2
>>          passdb backend = samba_dsdb
>>          printcap cache time = 0
>>          printcap name = /dev/null
>>          realm = EXAMPLE.COM
>>          server role = active directory domain controller
>>          server string = Samba Server Version %v
>>          template homedir = /home/%ACCOUNTNAME%
>>          template shell = /bin/bash
>>          tls cafile = tls/ad-rep2.example.com-2020-intermediate.pem
>>          tls certfile = tls/ad-rep2.example.com-2020-certonly.pem
>>          tls keyfile = tls/ad-rep2.example.com-2020.key
>>          tls verify peer = ca_and_name
>>          workgroup = EXAMPLE
>>          winbindd:use external pipes = true
>>          smbd:backgroundqueue = no
>>          rpc_daemon:spoolssd = embedded
>>          rpc_server:tcpip = no
>>          rpc_server:spoolss = embedded
>>          rpc_server:winreg = embedded
>>          rpc_server:ntsvcs = embedded
>>          rpc_server:eventlog = embedded
>>          rpc_server:srvsvc = embedded
>>          rpc_server:svcctl = embedded
>>          rpc_server:default = external
>>          idmap_ldb:use rfc2307 = yes
>>          idmap config * : backend = tdb
>>          lpq command = lpq -P'%p'
>>          lprm command = lprm -P'%p' %j
>>          map archive = No
>>          print command = lpr -r -P'%p' %s
>>          printing = bsd
>>
>> Intermediate certificates
>> (tls/ad-rep2.example.com-2020-intermediate.pem) are ordered as
mentioned
>> in sectigo's documentation :
>>
>> "SSLCertificateChainFile: Intermediate(s)/Root only,  PEM encoded
(it
>> contains the certificates from the leaf, without the certificate
itself,
>> to the root)"
>>
>> Thanks
>>
>

Seemingly Similar Threads

Search for more reasonably related threads

samba - Aug 2020 - Problem with intermediate certificate (tls cafile)

[Samba] Problem with intermediate certificate (tls cafile)

[Samba] Problem with intermediate certificate (tls cafile)

[Samba] Problem with intermediate certificate (tls cafile)

Seemingly Similar Threads