On Mon, Jul 23, 2007 at 09:58:37PM -0700, Howard Chu wrote:
># Cannot get this working!
This only works with recent OpenSSL 0.9.8 releases. You didn't mention
which version of OpenSSL you're using. And since this entire subject is
purely an OpenSSL matter and not an LDAP matter, that's a pretty key piece
I used 0.9.7d.
That information (a minimal version of OpenSSL is required for it to work)
is quite important. Where was I supposed to find it? I've lost a few hours
trying to get CRLworking, I'd have been better reading the right document.
>In order to have this working, we need x509 certificate that
>the subjectAltName extension. This is not an OpenLDAP-specific problem,
>but the information about how to do it seems difficult to find, hence,
>here is the result of my experiments.
The information is all at your fingertips. You just haven't absorbed it yet.
I beleive the information (which exists, I agree) is not very well oriented
for the newcomer that tries to set up a new configuration.
Also note "subject alternative name" means exactly that -
*alternative* names for the identity. You don't have to list the real name
here, since that's already going into the subject CN. It does no harm, but
it does no good either. (And it makes your cert bigger than it needs to
Thanks for that hint.
>Install ca.crt and srv1.crt (srv2.crt) on srv1 (srv2), and
>with this in slapd.conf:
Setting "sasl-secprops none" is never a good idea. Why did you put this
I have users using plaintext login/password through TLS. Those are validated
through SASL. As I understood, using plaintext password requires
"sasl-secprops none", is that wrong?
No, that's not what it does. It turns off all security
requirements in the
SASL layer, allowing all insecure mechanisms to be used. A rather big
mistake, after you've gone to the trouble of enabling secure authentication
In my setup, the syncrepl consumer uses certificate and gets sensitive
information such as userPassword. Users can use plaintext password over
TLS and cannot get password hashes. Is it that odd?