Re: [Fedora-directory-users] question about SSL configuration with IP takeover HA setup

Ryan Braun
2007-09-21T16:14:01Z

On Thursday 20 September 2007 21:36, George Holbert wrote:

Ok so I managed to create a new certificate using subjectAltName extenstions,
and it works as advertised.  I can run ldapsearchs on eastldap on both
eastldap0.

Now my question is for generating certs for the other servers.  Now that I
have the CA cert on eastldap0,  I would assume I need to install the CA on
each additional server.  Can I just copy and paste the cacert.asc into the
manage certificate wizard?

Then I would generate new certs for each server.  Now do I need to generate
the certs all from eastldap0?  or once the CA cert is installed on the rest
of the boxes,  am I able to generate the required certs on each box?  Is it
generally a good idea to keep all the cert creation in a central location?

And for the clients,  all they need is the one cacert.asc to be able to
encrypt comms with each server?

Thanks

Ryan


>
> Each running FDS server instance will have just one SSL certificate.
> If you want your server to identify with multiple names, you can either:
> - Do a cert with subjectAltName extensions.
> - Do a cert with a wildcard in the subject''s CN (e.g.,
cn=*.test.com).
>
> LDAP / SSL client support for these varies, so you will probably want to
> test both ways and see what works with better with your clients.
> If it works for you, the subjectAltName method is probably preferable,
> because you can precisely list the valid names for your server.
>
> Also, consider keeping it simple and just doing certs with single names
> (e.g.,  one cert each for ''westldap.test.com'' and
''eastldap.test.com''),
> and installing that same cert on each server which should have that SSL
> identity.  This is actually a pretty common way to do it, though it will
> limit your ability to make SSL connections to individual nodenames, like
> eastldap0.test.com (as you noticed).
>
> Ryan Braun wrote:
> > Hey guys,  installed FDS on a couple debian servers this week and am
> > liking it so far.  I have a couple questions regarding SSL/TLS setup
with
> > servers setup for  IP takeover type HA setup.  Keep in mind I have
some
> > experience with the LDAP side of things,  it''s the ssl and
all the
> > different certs and whatnot that keeps me up at night.
> >
> > Essentially what I''m looking at is a 4 way multimaster setup,
ending up
> > with 2 HA pairs of servers.  call them eastldap and westldap.
I''ve
> > implemented the east side in my test lab and have it replicating and
can
> > pull any user info I need off the directory no problem.
> >
> > so
> > eastldap0.test.com ip 192.168.0.11
> > eastldap1.test.com ip 192.168.0.12
> > and the virtual interface on whichever machine is master would be
> > eastldap.test.com ip 192.168.0.10
> >
> > and then the exact same setup with the last 2
> >
> > westldap0.test.com ip 192.168.1.11
> > westldap1.test.com ip 192.168.1.12
> > westldap.test.com ip 192.168.1.10
> >
> > Once everything is setup and running clients would be primarily only
> > connecting to either virtual interface west/eastldap using TLS over
port
> > 389 and the 4 masters replicating with encryption (not sure but I
imagine
> > this takes place on ldaps port).
> >
> > I followed the instructions on the howto:ssl page and created a cert
> > located on eastldap0.  But instead of using the eastldap0.test.com as
the
> > cn,  I used eastldap.test.com.  Cert installed ok, made sure eastldap0
> > was the HA master and restarted fds.
> >
> > When I copied over the cacert to a linux client,  I can run searches
> > using ldapsearch -ZZ -h eastldap.test.com.  Server logs and wire
sniffs
> > confirm everything is coming back encrypted.  It seems to be behaving
as
> > expected, when I try ldapsearch -ZZ -h eastldap0.test.com,  it pukes
with
> > error 11 additional info: TLS: hostname does not match CN in peer
> > certificate,  which is right as the name in the cert is
> > eastldap.test.com.
> >
> > So it would appear I''m on my way,  I just am not sure about
what certs I
> > need now, and how to add them properly.  I would think I need at the
very
> > least
> >
> > eastldap0
> > - eastldap0.test.com cert
> > - eastldap.test.com cert
> > eastldap1
> > - eastldap1.test.com cert
> > - eastldap.test.com cert
> > westldap0
> > - westldap0.test.com cert
> > - westldap.test.com cert
> > westldap1
> > - westldap1.test.com cert
> > - westldap.test.com cert
> >
> > I''m just not sure if that is the proper way to go about it.
Also,  I
> > would like to have the clients to be able to have all the cacerts to
be
> > able to communicate with all virtual and physical address'' if
need be.
> > Later on,  I would be adding probably 5 or 6 consumer read only
replicas
> > inbetween the suppliers and the clients,  but one must walk before
they
> > run I guess :)
> >
> > Long post I know,  just trying to make sure I get all the important
stuff
> > out there.  Be kind if I was using the incorrect terminology for the
> > certs/cacerts :)
> >
> > Ryan
> >
> > PS.  anyone have a good SSL for dummies reference that lays out what
the
> > heck is going on with SSL (pems,keys,certs,cacerts etc)
> >
> > --