"BM" == Buchan Milne bgmilne@staff.telkomsa.net writes:
I'd like to set up LDAP command line tools to point to a server -- say localhost -- that has a certificate with an arbitrary name in it -- say `my-domain.com`.
BM> Either:
BM> 1)Add an entry to /etc/hosts so that the name on the certificate BM> resolves to the correct IP address, and always use the name on BM> any connection where you want certificate validation or
BM> 2)Add TLS_REQCERT allow to the OpenLDAP ldap.conf. If you are BM> using anything besides OpenLDAP software (nss_ldap,pam_ldap) be BM> aware that their configuration is not identical ...
or, if you can, use the subjectAltName certificate extension. see the administrator's guide, 14.1.1. works as expected and there's no funky client side configuration required.
k.