Fedora directory users - Jul 2006 - certutil: generating new .db files for server

Hi all,

I''m generating new *.db files for my server, where I will install a new
root
ca, and a new server cert (new *.db files allows me to easily test and back
out). I have a couple of questions about *.db files and how FDS uses them:

1. When I use certutil -N to create the new db files, is the value I give to
the ''-P'' flag arbitrary, or does the server look for a
specific value based
on instance name or something? I have new files called
''slapd-ldap-cert8.db''
and ''slapd-ldap-key3.db'', because I thought this prefix value
was arbitrary,
but FDS fails to start because it says that files ''
slapd-ldap-testbox-cert8.db'' and
''slapd-ldap-testbox-key3.db'' are missing.
Those are the *old* db file names.

2. Related to 1, how do I (from the command line) change what files FDS
looks for? Is this possible? Recommended?

3. Is it true that I cannot reuse a signed server certificate in a newly
created database, even if the new database has the same root ca installed as
the old one? I need to generate a request every time I run certutil -N?

4. Are there other rules that these files have to conform to in order for
the server to start up? Are there docs on this that I''ve missed? Links?
I''ve
seen the mozilla NSS docs, but they''re mostly for developers (except
for the
decent certutil reference), and the RHDS docs do everything from the GUI as
far as I''ve seen.

Thanks.
brian.

Brian Jones wrote:
> Hi all,
> 
> I''m generating new *.db files for my server, where I will install
a new
> root
> ca, and a new server cert (new *.db files allows me to easily test and back
> out). I have a couple of questions about *.db files and how FDS uses them:
> 
> 1. When I use certutil -N to create the new db files, is the value I 
> give to
> the ''-P'' flag arbitrary, or does the server look for a
specific value based
> on instance name or something? I have new files called 
> ''slapd-ldap-cert8.db''
> and ''slapd-ldap-key3.db'', because I thought this prefix
value was
> arbitrary,
> but FDS fails to start because it says that files ''
> slapd-ldap-testbox-cert8.db'' and
''slapd-ldap-testbox-key3.db'' are missing.
> Those are the *old* db file names.
By default the prefix needs to match the FDS instance name. Because the 
database files are stored in a common directory a way was needed to 
discretely name them, hence the prefix.
> 
> 2. Related to 1, how do I (from the command line) change what files FDS
> looks for? Is this possible? Recommended?
I''ve never done this but a cursory look at the code found nsCertfile
and
nsKeyfile. I guess in theory you could change those values (stored in 
LDAP, of course) and point to new key/cert files. I grepped them out of 
dse.ldif to see the current settings.
> 
> 3. Is it true that I cannot reuse a signed server certificate in a newly
> created database, even if the new database has the same root ca 
> installed as
> the old one? I need to generate a request every time I run certutil -N?
The signed certificate is only half of what you need. You also need the 
private key. Without more information on what you''re trying to do I 
can''t really make a recommendation.
> 
> 4. Are there other rules that these files have to conform to in order for
> the server to start up? Are there docs on this that I''ve missed?
Links?
> I''ve
> seen the mozilla NSS docs, but they''re mostly for developers
(except for
> the
> decent certutil reference), and the RHDS docs do everything from the GUI as
> far as I''ve seen.
> 
 From the perspective of the command-line utilities, they could care 
less what the files are named as long as they end in cert8.db and 
key3.db. The prefix flag (-P) lets you set arbitrary data before that.

For a bit more detail on how NSS is initialized, look at the function 
slapd_nss_init() at 
http://cvs.fedora.redhat.com/lxr/dirsec/source/ldapserver/ldap/servers/slapd/ssl.c

It looks like the only thing hardcoded is the directory where the files 
are located, server-root/alias. But like I said, I''ve never tried 
renaming those files in the DS. I just wonder if this would cause 
confusion in the future, or with the console.

rob

Hi Rob, thanks for the reply. I''ve clarified inline:

On 7/10/06, Rob Crittenden <rcritten@redhat.com>
wrote:
>
> Brian Jones wrote:
>
> > 3. Is it true that I cannot reuse a signed server certificate in a
newly
> > created database, even if the new database has the same root ca
> > installed as
> > the old one? I need to generate a request every time I run certutil
-N?
>
> The signed certificate is only half of what you need. You also need the
> private key. Without more information on what you''re trying to do
I
> can''t really make a recommendation.


Right, I know I need the root ca and the server cert (signed by said root
ca) both installed in the db. What I''m doing is this:

I have /opt/fedora-ds/alias set up as a symlink to alias-test1, alias-test2,
etc. I have a couple of these directories around for... um.... testing :)

What I want to confirm is whether or not I can use, for example, the cert
request I generated (using certutil -R) for the db files in alias-test1 for
the new db files created in alias-test2.


Thanks for the input.
brian.


>
>
>

Brian Jones wrote:
> Hi Rob, thanks for the reply. I''ve clarified inline:
> 
> On 7/10/06, Rob Crittenden <rcritten@redhat.com> wrote:
>>
>> Brian Jones wrote:
>>
>> > 3. Is it true that I cannot reuse a signed server certificate in a
>> newly
>> > created database, even if the new database has the same root ca
>> > installed as
>> > the old one? I need to generate a request every time I run
certutil -N?
>>
>> The signed certificate is only half of what you need. You also need the
>> private key. Without more information on what you''re trying to
do I
>> can''t really make a recommendation.
> 
> 
> 
> Right, I know I need the root ca and the server cert (signed by said root
> ca) both installed in the db. What I''m doing is this:
> 
> I have /opt/fedora-ds/alias set up as a symlink to alias-test1, 
> alias-test2,
> etc. I have a couple of these directories around for... um.... testing :)
> 
> What I want to confirm is whether or not I can use, for example, the cert
> request I generated (using certutil -R) for the db files in alias-test1 for
> the new db files created in alias-test2.
Ok, so what you want to do is issue the certificate once, then perhaps 
move it to other directories? If so here is what you do:

1. Generate a new database (or use an existing one, it doesn''t really 
matter).
2. generate your Certifiacte Server Request (CSR)
3. Sign this with your CA
4. Import the new server certificate into your database (certutil -A ...)
5. Export this server cert, which I''ve nicknamed Server-Cert, into a 
PKCS#12 file with:

pk12util -o server.p12 -n Server-Cert -P slapd-foo- -d alias

6. You can now import this into another certificate database with

pk12util -i server.p12 -n Server-Cert -P slapd-bar- -d alias-test1

The other alternative is to simply copy the database files between 
directories, but you''ll pick up all certificates/keys rather than 
discretely copying a single cert/key combo.

rob