7:08 a.m.
Hey there,
I've got a simple enough question: is it possible to use a certificate
for TLS (through the TLSCertificateFile directive) on which the FQDN of
the LDAP server is not on the CN but instead on the alternative name? I
tried this, but I'm getting a "TLS init def ctx failed: -64" and I
thought it might be because of this issue. I also couldn't find a list
of the error numbers and their descriptions, making it harder for me to
understand what's wrong...
Cheers,
--
Daniel Gomes (SysAdmin)
dgomes(a)ipfn.ist.utl.pt
Ext. 3487 - 218419487
Instituto de Plasmas e Fusão Nuclear
Instituto Superior Técnico - UTL
Av. Rovisco Pais - 1049-001 Lisboa - Portugal
8:32 a.m.
Am Mon, 31 May 2010 15:08:15 +0100
schrieb Daniel Gomes <dgomes(a)ipfn.ist.utl.pt>:
Hey there,
I've got a simple enough question: is it possible to use a
certificate for TLS (through the TLSCertificateFile directive) on
which the FQDN of the LDAP server is not on the CN but instead on the
alternative name? I tried this, but I'm getting a "TLS init def ctx
failed: -64" and I thought it might be because of this issue. I also
couldn't find a list of the error numbers and their descriptions,
making it harder for me to understand what's wrong...
add subjectAltname=DNS:alternate.host.my.domain
to the server certificate
-Dieter
--
Dieter Klünter | Systemberatung
sip: +49.40.20932173
http://www.dpunkt.de/buecher/2104.html
GPG Key ID:8EF7B6C6
9:54 a.m.
2010/5/31 Daniel Gomes <dgomes(a)ipfn.ist.utl.pt>:
Hey there,
I've got a simple enough question: is it possible to use a certificate for
TLS (through the TLSCertificateFile directive) on which the FQDN of the LDAP
server is not on the CN but instead on the alternative name? I tried this,
but I'm getting a "TLS init def ctx failed: -64" and I thought it might be
because of this issue. I also couldn't find a list of the error numbers and
their descriptions, making it harder for me to understand what's wrong...
Cheers,
--
You can. Did that a few weeks ago.
--
Frank Van Damme
A: Because it destroys the flow of the conversation.
Q: Why is it bad?
A: No, it's bad.
Q: Should I top post in replies to mailing lists or on Usenet?
6:21 a.m.
Turned out to be a permissions error, quickly followed by the
(apparently common) GnuTLS issues. Since having TLS on that server is
not demanding (it's just a slave), I don't feel like trying to find a
solution. I guess I'll just later compile it by hand with OpenSSL (which
is what I did on the master server).
Thanks for the help anyway!
Em 31-05-2010 17:54, Frank Van Damme escreveu:
2010/5/31 Daniel Gomes<dgomes(a)ipfn.ist.utl.pt>:
> Hey there,
>
> I've got a simple enough question: is it possible to use a certificate for
> TLS (through the TLSCertificateFile directive) on which the FQDN of the LDAP
> server is not on the CN but instead on the alternative name? I tried this,
> but I'm getting a "TLS init def ctx failed: -64" and I thought it might
be
> because of this issue. I also couldn't find a list of the error numbers and
> their descriptions, making it harder for me to understand what's wrong...
>
> Cheers,
>
> --
>
You can. Did that a few weeks ago.
--
Daniel Gomes (SysAdmin)
dgomes(a)ipfn.ist.utl.pt
Ext. 3487 - 218419487
Instituto de Plasmas e Fusão Nuclear
Instituto Superior Técnico - UTL
Av. Rovisco Pais - 1049-001 Lisboa - Portugal
4934
days inactive
4935
days old
openldap-technical@openldap.org
3 comments
3 participants
participants (3)
-
Daniel Gomes -
Dieter Kluenter -
Frank Van Damme