Can someone please tell me if I have this right?
1) Create certs for FDS server.
2) export servercerts on FDS.
3) install Active Directory and certificate services ( Enterprise Root CA )
4) Setup Active Directory for SSL ( tested with ldp.exe )
5) Export AD cert, import into FDS
6) Install PassSync, import servercerts from FDS
7) Test ldapsearch over SSL to AD.
I have just upgraded to Windows server 2003 R2 and I can''t get SSL from
FDS to AD working again.
I get this error.
../shared/bin/ldapsearch -Z -P . -h ad-server -p 636 -D
"cn=administrator,cn=users,dc=xxx,dc=xxx,dc=xxx" -w - -s sub -b
"cn=users,dc=xxx,dc=xxx,dc=xxx" "cn=*" -v
ldap_simple_bind: Can''t contact LDAP server
SSL error -8179 (Peer''s Certificate issuer is not recognized.)
Thanks in advance.
J.G.
Jeff Gamsby wrote:> > Can someone please tell me if I have this right? > > 1) Create certs for FDS server. > 2) export servercerts on FDS. > 3) install Active Directory and certificate services ( Enterprise Root > CA ) > 4) Setup Active Directory for SSL ( tested with ldp.exe ) > 5) Export AD cert, import into FDS > 6) Install PassSync, import servercerts from FDS > 7) Test ldapsearch over SSL to AD. > > I have just upgraded to Windows server 2003 R2 and I can''t get SSL > from FDS to AD working again. > > I get this error. > > ../shared/bin/ldapsearch -Z -P . -h ad-server -p 636 -D > "cn=administrator,cn=users,dc=xxx,dc=xxx,dc=xxx" -w - -s sub -b > "cn=users,dc=xxx,dc=xxx,dc=xxx" "cn=*" -vAssuming you''re not using cert8.db and key3.db as your key/cert db names, the argument to -P should be the full path and filename of the key/cert database e.g. -P /opt/fedora-ds/alias/slapd-instance-cert8.db.> > ldap_simple_bind: Can''t contact LDAP server > SSL error -8179 (Peer''s Certificate issuer is not recognized.) > > Thanks in advance. > > J.G. > > > > > -- > Fedora-directory-users mailing list > Fedora-directory-users@redhat.com > https://www.redhat.com/mailman/listinfo/fedora-directory-users
Thanks, I tried that, it doesn''t seem to matter. When I had it running on a Win2k server, it worked with the "-P ." I''m wondering if there is anything that has to be done differently when using Win2003 vs. Win2k servers? I guess it could be a DNS problem. I''m looking into that now. Any suggestions are welcome. Richard Megginson wrote:> Jeff Gamsby wrote: >> >> Can someone please tell me if I have this right? >> >> 1) Create certs for FDS server. >> 2) export servercerts on FDS. >> 3) install Active Directory and certificate services ( Enterprise >> Root CA ) >> 4) Setup Active Directory for SSL ( tested with ldp.exe ) >> 5) Export AD cert, import into FDS >> 6) Install PassSync, import servercerts from FDS >> 7) Test ldapsearch over SSL to AD. >> >> I have just upgraded to Windows server 2003 R2 and I can''t get SSL >> from FDS to AD working again. >> >> I get this error. >> >> ../shared/bin/ldapsearch -Z -P . -h ad-server -p 636 -D >> "cn=administrator,cn=users,dc=xxx,dc=xxx,dc=xxx" -w - -s sub -b >> "cn=users,dc=xxx,dc=xxx,dc=xxx" "cn=*" -v > Assuming you''re not using cert8.db and key3.db as your key/cert db > names, the argument to -P should be the full path and filename of the > key/cert database e.g. -P /opt/fedora-ds/alias/slapd-instance-cert8.db. > >> >> ldap_simple_bind: Can''t contact LDAP server >> SSL error -8179 (Peer''s Certificate issuer is not recognized.) >> >> Thanks in advance. >> >> J.G. >> >> >> >> >> -- >> Fedora-directory-users mailing list >> Fedora-directory-users@redhat.com >> https://www.redhat.com/mailman/listinfo/fedora-directory-users > ------------------------------------------------------------------------ > > -- > Fedora-directory-users mailing list > Fedora-directory-users@redhat.com > https://www.redhat.com/mailman/listinfo/fedora-directory-users >
Jeff Gamsby wrote:> Thanks, > > I tried that, it doesn''t seem to matter. When I had it running on a > Win2k server, it worked with the "-P ."Then you probably have a file called cert8.db in that directory.> I''m wondering if there is anything that has to be done differently > when using Win2003 vs. Win2k servers?Not that I know of.> > I guess it could be a DNS problem. I''m looking into that now.Yes, could be DNS.> > Any suggestions are welcome. > > > Richard Megginson wrote: >> Jeff Gamsby wrote: >>> >>> Can someone please tell me if I have this right? >>> >>> 1) Create certs for FDS server. >>> 2) export servercerts on FDS. >>> 3) install Active Directory and certificate services ( Enterprise >>> Root CA ) >>> 4) Setup Active Directory for SSL ( tested with ldp.exe ) >>> 5) Export AD cert, import into FDS >>> 6) Install PassSync, import servercerts from FDS >>> 7) Test ldapsearch over SSL to AD. >>> >>> I have just upgraded to Windows server 2003 R2 and I can''t get SSL >>> from FDS to AD working again. >>> >>> I get this error. >>> >>> ../shared/bin/ldapsearch -Z -P . -h ad-server -p 636 -D >>> "cn=administrator,cn=users,dc=xxx,dc=xxx,dc=xxx" -w - -s sub -b >>> "cn=users,dc=xxx,dc=xxx,dc=xxx" "cn=*" -v >> Assuming you''re not using cert8.db and key3.db as your key/cert db >> names, the argument to -P should be the full path and filename of the >> key/cert database e.g. -P /opt/fedora-ds/alias/slapd-instance-cert8.db. >> >>> >>> ldap_simple_bind: Can''t contact LDAP server >>> SSL error -8179 (Peer''s Certificate issuer is not recognized.) >>> >>> Thanks in advance. >>> >>> J.G. >>> >>> >>> >>> >>> -- >>> Fedora-directory-users mailing list >>> Fedora-directory-users@redhat.com >>> https://www.redhat.com/mailman/listinfo/fedora-directory-users >> ------------------------------------------------------------------------ >> >> -- >> Fedora-directory-users mailing list >> Fedora-directory-users@redhat.com >> https://www.redhat.com/mailman/listinfo/fedora-directory-users >> > > -- > Fedora-directory-users mailing list > Fedora-directory-users@redhat.com > https://www.redhat.com/mailman/listinfo/fedora-directory-users