I have setup a windows sync agreement, and have followed the instructions, however I am seeing this error, even when I do an ldapsearch command from the 389 server:
ldap_simple_bind: Can't contact LDAP server
******* SSL error -8179 (Peer's Certificate issuer is not recognized.)
I'm using self signed certs, did I miss something?
--
389 users mailing list
389-users@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/389-users
06-21-2011, 05:06 PM
Rich Megginson
win sync error
On 06/20/2011 02:47 PM, solarflow99 wrote:
I have setup a windows sync agreement, and have
followed the instructions, however I am seeing this error, even
when I do an ldapsearch command from the 389 server:
ldap_simple_bind: Can't contact LDAP server
******* SSL error -8179 (Peer's Certificate issuer is not
recognized.)
I'm using self signed certs, did I miss something?
Probably.* There are many steps involved in getting winsync to use
TLS/SSL to talk to AD, and getting AD PassSync to use TLS/SSL to
talk to DS.* Which instructions did you follow?
--
389 users mailing list
389-users@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/389-users
--
389 users mailing list
389-users@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/389-users
06-21-2011, 05:25 PM
solarflow99
win sync error
I'm using self signed certs, did I miss something?
Probably.* There are many steps involved in getting winsync to use
TLS/SSL to talk to AD, and getting AD PassSync to use TLS/SSL to
talk to DS.* Which
**
From the Docs listed online: http://docs.redhat.com/docs/en-US/Red_Hat_Directory_Server/8.1/html/Administration_Guide/Windows_Sync-Configuring_Windows_Sync.html
and I went over everything else I could possibly find too.* It seems in the case of self signed certificates, the windows CA has to exported as a .cer file, and imported in 389 with:* certutil -d . -A -n "AD Cert" -t "CTu,u,u" -i ad-cert.cer
*
--
389 users mailing list
389-users@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/389-users
06-21-2011, 05:52 PM
solarflow99
win sync error
On Tue, Jun 21, 2011 at 1:39 PM, Rich Megginson <rmeggins@redhat.com> wrote:
On 06/21/2011 11:23 AM, solarflow99 wrote:
I'm using self signed certs, did I miss
something?
Probably.* There are
many steps involved in getting winsync to use TLS/SSL to
talk to AD, and getting AD PassSync to use TLS/SSL to talk
to DS.* Which
From the Docs listed online: http://docs.redhat.com/docs/en-US/Red_Hat_Directory_Server/8.1/html/Administration_Guide/Windows_Sync-Configuring_Windows_Sync.html
and I went over everything else I could possibly find
too.* It seems in the case of self signed certificates,
Are you talking about self signed certs for 389 or for AD?*
I guess that would be both.* This is all internal so no servers need real third party signed certificates, just trying to get it to work.
**
the windows CA has to exported as a .cer file, and
imported in 389 with:* certutil -d . -A -n "AD Cert" -t "CTu,u,u"
-i ad-cert.cer
Yes, that is correct.* So what's the problem?
It wasn't mentioned anywhere, so once I guessed what had to be done, now i'm getting a different error:
--
389 users mailing list
389-users@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/389-users
06-21-2011, 06:51 PM
Rich Megginson
win sync error
On 06/21/2011 11:52 AM, solarflow99 wrote:
On Tue, Jun 21, 2011 at 1:39 PM, Rich Megginson <rmeggins@redhat.com>
wrote:
On 06/21/2011 11:23 AM, solarflow99 wrote:
I'm using self signed certs,
did I miss something?
Probably.*
There are many steps involved in getting winsync
to use TLS/SSL to talk to AD, and getting AD
PassSync to use TLS/SSL to talk to DS.* Which
From the Docs listed online: http://docs.redhat.com/docs/en-US/Red_Hat_Directory_Server/8.1/html/Administration_Guide/Windows_Sync-Configuring_Windows_Sync.html
and I went over everything else I
could possibly find too.* It seems in the case of self
signed certificates,
Are you talking about self signed certs for 389 or for AD?*
I guess that would be both.* This is all internal so no
servers need real third party signed certificates, just trying
to get it to work.
Ok, I'm confused.* The RHDS 8.2 Admin Guide talks about setting up
AD for TLS/SSL by installing the MS CA in Enterprise Root CA mode,
creating a cert request, and using MS CA to issue the AD server
cert.* It doesn't say anything about creating self signed certs for
AD.
**
the windows CA has to exported as
a .cer file, and imported in 389 with:* certutil -d . -A
-n "AD Cert" -t "CTu,u,u" -i ad-cert.cer
Yes, that is correct.* So what's the problem?
It wasn't mentioned anywhere, so once I guessed what had to be
done, now i'm getting a different error:
You have to use the full DN - something like -D
"cn=administrator,cn=users,dc=389testdomain,dc=loc al"
--
389 users mailing list
389-users@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/389-users
--
389 users mailing list
389-users@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/389-users
06-22-2011, 05:37 PM
solarflow99
win sync error
On Tue, Jun 21, 2011 at 2:51 PM, Rich Megginson <rmeggins@redhat.com> wrote:
On 06/21/2011 11:52 AM, solarflow99 wrote:
On Tue, Jun 21, 2011 at 1:39 PM, Rich Megginson <rmeggins@redhat.com>
wrote:
On 06/21/2011 11:23 AM, solarflow99 wrote:
I'm using self signed certs,
did I miss something?
Probably.*
There are many steps involved in getting winsync
to use TLS/SSL to talk to AD, and getting AD
PassSync to use TLS/SSL to talk to DS.* Which
From the Docs listed online: http://docs.redhat.com/docs/en-US/Red_Hat_Directory_Server/8.1/html/Administration_Guide/Windows_Sync-Configuring_Windows_Sync.html
and I went over everything else I
could possibly find too.* It seems in the case of self
signed certificates,
Are you talking about self signed certs for 389 or for AD?*
I guess that would be both.* This is all internal so no
servers need real third party signed certificates, just trying
to get it to work.
Ok, I'm confused.* The RHDS 8.2 Admin Guide talks about setting up
AD for TLS/SSL by installing the MS CA in Enterprise Root CA mode,
creating a cert request, and using MS CA to issue the AD server
cert.* It doesn't say anything about creating self signed certs for
AD.*
Ya, thats what I mean.* It would be nice if there was an example of getting this to work with self signed certs.* I could add that to the wiki if that would useful for anyone else.
win sync error
