Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Other than noticing something like this:

yourid@linuxtpf:~/certificates> ls -l
lrwxrwxrwx  1 yourid users   9 2009-04-07 18:06 50a694ac.0 -> cert2.pem #<-- was missing
lrwxrwxrwx  1 yourid users   9 2009-04-07 18:06 5170a0d9.0 -> cert3.pem #<-- was missing too...
-rw-------  1 yourid users 756 2009-04-07 18:02 cert2.pem
-rw-------  1 yourid users 747 2009-04-07 18:02 cert3.pem

was missing from my server and after adding them fixed LDAPS connections that were failing at the ldap_bind stage in the LDAP connection process.

What is really going on and why did I need to create symbolic links for CAPATH by running the following command?

yourid@linuxtpf:~/certificates> c_rehash /home/yourid/certificates

share|improve this question

2 Answers 2

Because some software finds the correct keys by looking in the configured directory for a file with a given certificate hash.

Hashing creates symlinks from the key id to the files with the human readable names.

share|improve this answer

The machine wants files like this. If you open the certificate you will see that the numbers match the hash provided within the certificate. This is so that the canonical hash of the certificate matches the name of the file. Remember: A certificate may contain multiple hostnames and aliaes, but it has only one hash.

50a694ac.0
5170a0d9.0

But me? I'm a human and those names are hard to decipher. So I use human-friendly symbolic links like this:

www.example.org.pem -> 50a694ac.0 
wiki.example.org.pem -> 5170a0d9.0

I my experience, the names www.example.org.pem and wiki.example.org.pem are usually symbolic links to the files named like 50a694ac.0. In your example you had the opposite-- the human-friendly names existed but not the hashed names. The human-readable names are sometimes optional.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.