FAQ Search Today's Posts Mark Forums Read
» Video Reviews

» Linux Archive

Linux-archive is a website aiming to archive linux email lists and to make them easily accessible for linux users/developers.


» Sponsor

» Partners

» Sponsor

Go Back   Linux Archive > Redhat > Fedora Directory

 
 
LinkBack Thread Tools
 
Old 11-09-2010, 04:39 PM
"Ryan Braun [ADS]"
 
Default duplicate existing ssl crenentials on another server ?

On November 9, 2010 04:19:01 pm Gerrard Geldenhuis wrote:
> >________________________________________
> >From: 389-users-bounces@lists.fedoraproject.org
> > [389-users-bounces@lists.fedoraproject.org] on behalf of Daniel Maher
> > [dma+389users@witbe.net] Sent: 09 November 2010 16:06
> >To: 389-users@lists.fedoraproject.org
> >Subject: Re: [389-users] duplicate existing ssl crenentials on another
> > server ?
> >
> >On 11/09/2010 04:27 PM, Gerrard Geldenhuis wrote:
> >> There is another document on the wiki which describes how to setup
> >> certificates for a vip.... that is similar to what you want to do. I
> >> can't find it at the moment but might be worth >trolling through the
> >> wiki again.
> >
> >Actually, the SSL howto has a section on VIPs (the only hit on a search,
> >in fact) :
> >http://directory.fedoraproject.org/wiki/Howto:SSL#Using_Subject_Alt_Name
> >
> >I gave it a second read-through, and it would seem to indicate that alt
> >names can be IPs as well as hostnames (i thought it was only the latter
> >that was possible).
> >
> >It would therefore appear to be possible to create a certificate that
> >with a series of alt names - in my scenario, there would literally be
> >one hostname and two IP addresses.
> >
> >Has anybody on the list done something similar ? Any advice ? Should
> >this just work outright ?
> >
> >(p.s. Angel Bosch Mora - turns out you may have been right the first
> >time ! ).
>
> I have not done it before... good luck and may the force be with you. :-)
>
> In all seriousness I don't know, if you get it working then steps and
> pointers back to the list would be great.
>
> Regards

Subject Alt Names extensions are exactly what you're looking for. Set the
initial cert name to the actual fqdn of the box you're running on. Then add
all other hostnames,fqdns, and ips as Subject alt name extensions.

For example, you have a 2 machine HA setup. ldap0.example.com (192.168.0.10)
and ldap1.example.com(192.168.0.11) with a virtual address of
ldap.example.com (192.168.0.12).

For ldap0, you would set the initial cert as ldap0.example.com, and then add
the following as
extenstions "ldap0,ldap.example.com,ldap,192.168.0.10,192.168. 0.12"

Now when you try and do an encrypted query, you can point to any of the
following in you query , and not get a cert error.

ldap0.example.com
ldap0
ldap.example.com
ldap
192.168.0.10
192.168.0.12

Ryan Braun
Aviation and Defence Services Division
Chief Information Officer Branch, Environment Canada
CIV: 204-833-2500x2625 CSN: 257-2625 FAX: 204-833-2558
E-Mail: Ryan.Braun@ec.gc.ca
--
389 users mailing list
389-users@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/389-users
 

Thread Tools




All times are GMT. The time now is 04:34 PM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.
Copyright 2007 - 2008, www.linux-archive.org