----- "Ivan Ordonez" <iordonez@nature.berkeley.edu> wrote:

  

Few more questions Gavin.

Our primary domain controller certificate is also expiring next month.
What is the best way to handle this? Does the certificate and keys on
the backup domain controller has any connection to the certs and keys
of the primary domain controller and the other backup domain
controller?
    

Other than being signed by the Certificate Authority, none. As long as
you use the same FQDN for the certs as before and the CA doesn't change, 
then all is good.

  

I would be relieve to hear that I can make brand new certificate and
keys for each machine and they have no connection with each other.

Thanks for all your help.

-Ivan


ghenry@OpenLDAP.org wrote:

----- "Ivan Ordonez" <iordonez@nature.berkeley.edu> wrote:

Looking at the debug log, it is expired. It puzzle me because the
certs on the other two machine are working correctly. Check their
expiry dates with:

openssl x509 -in /usr/local/etc/openldap/ldap-slave_cert.pem -text

Since this is the case (certificate expires), is it safe to create a
new one for this machine? Of course, then sign it with the cacert,
something like:

./CA.sh -newreq
./CA.sh -sign