diff options
Diffstat (limited to 'zarb-ml/mageia-sysadm/2012-February/004218.html')
| -rw-r--r-- | zarb-ml/mageia-sysadm/2012-February/004218.html | 102 |
1 files changed, 102 insertions, 0 deletions
diff --git a/zarb-ml/mageia-sysadm/2012-February/004218.html b/zarb-ml/mageia-sysadm/2012-February/004218.html new file mode 100644 index 000000000..be21239a7 --- /dev/null +++ b/zarb-ml/mageia-sysadm/2012-February/004218.html @@ -0,0 +1,102 @@ +<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> +<HTML> + <HEAD> + <TITLE> [Mageia-sysadm] ldap server certificate (was: Re: [Mageia-discuss] Fosdem report) + </TITLE> + <LINK REL="Index" HREF="index.html" > + <LINK REL="made" HREF="mailto:mageia-sysadm%40mageia.org?Subject=Re%3A%20%5BMageia-sysadm%5D%20ldap%20server%20certificate%20%28was%3A%20Re%3A%0A%09%5BMageia-discuss%5D%20Fosdem%20report%29&In-Reply-To=%3C201202151812.11280.bgmilne%40zarb.org%3E"> + <META NAME="robots" CONTENT="index,nofollow"> + <META http-equiv="Content-Type" content="text/html; charset=us-ascii"> + <LINK REL="Previous" HREF="004215.html"> + <LINK REL="Next" HREF="004213.html"> + </HEAD> + <BODY BGCOLOR="#ffffff"> + <H1>[Mageia-sysadm] ldap server certificate (was: Re: [Mageia-discuss] Fosdem report)</H1> + <B>Buchan Milne</B> + <A HREF="mailto:mageia-sysadm%40mageia.org?Subject=Re%3A%20%5BMageia-sysadm%5D%20ldap%20server%20certificate%20%28was%3A%20Re%3A%0A%09%5BMageia-discuss%5D%20Fosdem%20report%29&In-Reply-To=%3C201202151812.11280.bgmilne%40zarb.org%3E" + TITLE="[Mageia-sysadm] ldap server certificate (was: Re: [Mageia-discuss] Fosdem report)">bgmilne at zarb.org + </A><BR> + <I>Wed Feb 15 17:12:10 CET 2012</I> + <P><UL> + <LI>Previous message: <A HREF="004215.html">[Mageia-sysadm] ldap server certificate (was: Re: [Mageia-discuss] Fosdem report) +</A></li> + <LI>Next message: <A HREF="004213.html">[Mageia-sysadm] ldap server certificate (was: Re: [Mageia-discuss] Fosdem report) +</A></li> + <LI> <B>Messages sorted by:</B> + <a href="date.html#4218">[ date ]</a> + <a href="thread.html#4218">[ thread ]</a> + <a href="subject.html#4218">[ subject ]</a> + <a href="author.html#4218">[ author ]</a> + </LI> + </UL> + <HR> +<!--beginarticle--> +<PRE>On Wednesday, 15 February 2012 11:32:35 Michael Scherer wrote: +><i> Le mardi 14 février 2012 à 17:54 +0100, Romain d'Alverny a écrit : +</I>><i> > On Tue, Feb 14, 2012 at 17:35, Michael Scherer <<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">misc at zarb.org</A>> wrote: +</I>><i> > >> It looks like we are still using a self-signed certificate on the ldap +</I>><i> > >> server. So it's required to have "TLS_REQCERT allow" in +</I>><i> > >> /etc/openldap/ldap.conf to be able to connect to the ldap server. +</I>><i> > >> +</I>><i> > >> Should we also use the *.mageia.org certificate on the ldap server ? +</I>><i> > +</I>><i> > Wouldn't that make sense? +</I>><i> +</I>><i> I fear that some tools would requires CA in a slightly different format +</I>><i> ( like key in one file, signature in another one ). +</I> +Key and cert should ideally be separate. + +><i> For example, postgresql seems to need this ( since I had to write a +</I>><i> special class for this, see rev 530 and 531 on adm svn. +</I>><i> This can surely be worked around, but I am not sure if this would +</I>><i> preserve the certificate signature +</I> +It should. + +><i> ( I am rather bad when it come to +</I>><i> certificate, each time, I think I understood openssl, and in fact, i +</I>><i> didn't ) +</I> +openssl x509 -out server.crt -in combined.pem +openssl rsa -out server.key -in combined.pem +? + +><i> > >> Or have our own CA with keys distributed by rpm packages in the +</I>><i> > >> distribution ? +</I>><i> > > +</I>><i> > > I would say "our own CA, but that's such a PITA :/ +</I>><i> > +</I>><i> > Why? +</I>><i> +</I>><i> Because openssl is weird :p +</I> +That's not the PITA. Handling CSRs, signatures etc. is. But, it is a problem +worth solving, as we really should have a solution for this. We have been +using OpenCA at work for this, with some semi-automated enrolment with +autosscep (and SCEP on Cisco routers, Cisco VPN client etc.). + +Regards, +Buchan +</PRE> + +<!--endarticle--> + <HR> + <P><UL> + <!--threads--> + <LI>Previous message: <A HREF="004215.html">[Mageia-sysadm] ldap server certificate (was: Re: [Mageia-discuss] Fosdem report) +</A></li> + <LI>Next message: <A HREF="004213.html">[Mageia-sysadm] ldap server certificate (was: Re: [Mageia-discuss] Fosdem report) +</A></li> + <LI> <B>Messages sorted by:</B> + <a href="date.html#4218">[ date ]</a> + <a href="thread.html#4218">[ thread ]</a> + <a href="subject.html#4218">[ subject ]</a> + <a href="author.html#4218">[ author ]</a> + </LI> + </UL> + +<hr> +<a href="https://www.mageia.org/mailman/listinfo/mageia-sysadm">More information about the Mageia-sysadm +mailing list</a><br> +</body></html> |