4

I'm trying to connect to multiple different LDAPS servers. A lot of the documentation I've seen recommends setting TLS_REQCERT never, but that strikes me as horribly unsecure to not verify the certificate. So I've set that to demand.

All the documentation I've seen says I need to update ldap.conf with a TLS_CACERT directive pointing to a .pem file. I've got that .pem file set up with the certificate from LDAP Server #1, and ldaps connections are happening fine.

I've now got to communicate securely with another LDAP server in another branch of my organization, that uses a different certificate. I've seen no documentation on how to do this, except 1 page that says I can simply put multiple (not chained) certificates in the same .pem file. I've done this and everything is working hunky dorey.

However, when I told a colleague what I did, he sounded like the sky was falling - putting 2 non-chained certificates into one .pem file is apparently the worst thing since ... ever.

Is there a more acceptable way to do this? Or is this the only accepted way?

4
  • very interested in why myself. I mean you just put the public version of the cert into the PEM file, so not sure why it's such a big deal.
    – emynd
    Jul 3, 2013 at 16:41
  • I'm interested as well. Public keys are, well ...public.
    – Nathan C
    Jul 3, 2013 at 17:14
  • 1
    His argument (when he was able to invent one) was - what if the file gets corrupted? Then you've lost both your certificates in one file. I thought that reasoning was tenuous at best. Jul 3, 2013 at 17:52
  • hence the reason for a backup solution :P
    – emynd
    Jul 3, 2013 at 18:03

1 Answer 1

0

Bundling unrelated certificates isn't an uncommon practice. It is the way that RedHat manages its CAs. However, that method can make it more difficult to remove certificates you no longer wish to trust. Perhaps you'd like to go the hashed certificate directory method. This is the way that debian manages its CAs.

  1. Put your certificates into a a single directory (e.g. /etc/ldap/cacerts).
  2. Run c_rehash with root privileges against your CA certificate directory (e.g. sudo c_rehash /etc/ldap/cacerts).
  3. Remove your TLS_CACERT option and set TLS_CACERTDIR to point to your CA certificates directory.
  4. Remember to run c_rehash every time you add a certificate and run sudo find -L /etc/ldap/cacerts -type l -exec rm {} + every time you remove one. (Re-running the command without altering anything doesn't have any ill effects, but is pointless.)
1
  • TLS_CACERTDIR is ignored by GNUtls, which is what openldap is linked to on Debian. Otherwise ya - that'd be the way to go. If it's not an uncommon practice, then I'll just leave it as-is because honestly your method seems like a (relatively) lot of work. Removing certificates shouldn't be a problem in the .pem file because there are only 2 certificates, and they're clearly labelled. Thanks for your answer though. Jul 5, 2013 at 19:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .