Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I've had some success using a Windows 2003 Server running as a Certification Authority signing certificates used in secure communications between Ubuntu Linux and Active Directory on Windows 2003 Server.

Now, I've set up a Linux CA using openssl and I have created a Windows 2003 request using certreq and signed the certificate and passed the CA public key and signed certificate back to Windows 2003. Everything looks OK in the certificates snap-in but I can't get secure communications to work now between Linux and Windows (using openssl s_client).

Can I use certreq to create requests for openssl? In my researchI've seen details on installing openssl on Windows to make the request (I may not be able to do this if this gets to production.)

Does anyone have a lab set-up and have the config file for the linux CA I could have a look a look at please?

share|improve this question
    
Found my answer in the instructions for Fedora directory services and LDAP (directory.fedoraproject.org/wiki/Howto:WindowsSync#With_TinyCA2). The important part was Server Certificate Settings MUST allow for the use of "Subject alternative name (subjectAltName)" of type IP Address. This is an AD requirement. (To get this option, you may need to go to Preferences->OpenSSLConfiguration, click on the Server Certificate Settings, and change Subject alternative name from Copy Email to ask). I also noticed on the windows side I did not need a password importing the pkcs#12 certificate. –  RichyL Sep 4 '11 at 0:12
    
If your comment solves the answer, please add as an answer. –  Zoredache Sep 7 '11 at 5:44

1 Answer 1

Found my answer in the instructions for Fedora directory services and LDAP.

The important part was Server Certificate Settings MUST allow for the use of "Subject alternative name" (subjectAltName) of type IP Address. This is an AD requirement.

(To get this option, you may need to go to Preferences -> OpenSSLConfiguration, click on the Server Certificate Settings, and change Subject alternative name from Copy Email to ask). I also noticed on the Windows side I did not need a password importing the pkcs#12 certificate.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.