Re: failover config: servers with same DNS address and TLS, subjectAltName extension
Howard Chu <hyc(a)symas.com> wrote:
When you run OpenLDAP's configure script you will see:
checking OpenSSL library version (CRL checking capability)... no
indicating that your OpenSSL library doesn't support it. Otherwise I suppose
you would see in your OpenSSL release notes/docs.
Yes, I discovered HAVE_OPENSSL_CRL. The problem is that this test
validates at mine, despite OpenSSL version (0.9.7d)
configure:19757: checking OpenSSL library version (CRL checking
capability)
configure:19791: result: yes
And then if I use TLS_CRLCHECK, LDAP operation will fail:
ldap_bind: Can't contact LDAP server (-1)
additional info: error:14090086:SSL
routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
I hope you'll agree with me that this is *very* misleading if CRL checks
are not supposed to work with 0.9.7d.
You posted your email as if it was a general solution for anybody
trying to
solve the aliased server name problem for TLS certificates.
Quoting myself: "here is the result of my experiments"
I wouldn't call that a claim of being an authoritative guide. I posted
it there with the hope it could be useful to other looking for the piece
of information I missed. It was not perfect, but that's not a problem,
since you and other kindly pointed out the errors. If you don't
discourage me too much, I may even post an update with your comments
included.
This part of your config is not part of that general solution, it is
specific to your deployment. In particular, the sasl-secprops setting is a
global option and affects all connections, whether they use TLS or not. As
such, you are allowing users to use login/plain over cleartext connections
as well as TLS connections. You might have taken precautions against this
in the other parts of your slapd.conf (using the security directive)
Yes, I have this. Is it fine?
security simple_bind=128
but you didn't indicate those precautions
anywhere in what you posted. So you will mislead anyone following your advice
into leaving their servers quite vulnerable.
I hope people do some testing before rolling a copy/pasted configuration
in production...
--
Emmanuel Dreyfus
http://hcpnet.free.fr/pubz
manu(a)netbsd.org