My Setup
- Mac OS X Server (El Capitan) as the OpenDirectory Server
- RHEL 6.5 connected via LDAP for authentication
I have set /etc/sysconfig/authconfig on the RHEL server to "FORCELEGACY=yes" just to test the LDAP connection. Now, however, I need to implement LDAP over TLS. I am required to use a self-signed certificate, but unfortunately my knowledge of SSL is limited. I have read dozens of guides and documents all pointing me to do something different to add a cert to the trusted database on RHEL. Nothing has worked so far.
What I Need to Accomplish
- Download the appropriate cert from OS X (in the proper format)
- Put the cert in the correct location(s) on RHEL
- Add the cert to RHEL's trusted certificate database
I've been banging my head against the wall on this, so any input is appreciated. Due to my limited knowledge of SSL, and the amount of varying information online please provide as much detail as possible in your responses! Thank you :)
For Reference
I followed these steps to attempt to import the SSL cert:
openssl s_client -connect server:443 <<<'' | openssl x509 -out /root/ca.pem
cp /root/ca.pem /etc/pki/ca-trust/source/anchors/
update-ca-trust enable; update-ca-trust extract
This did nothing. The commands executed fine, but I still had an error in /var/log/messages that said TLS could not be started due to an untrusted certificate. I then tried adding the cert manually:
cp /root/ca.pem /etc/pki/tls/certs
cd /etc/pki/tls/certs
ln -sv ca.pem $(openssl x509 -in ca.pem -noout -hash).0
This also did nothing.
I took a look at this RedHat guide about certutil, but it was asking for the certdbPath and I wasn't quite sure what that would be. There example was:
certutil -L -d certdbPath -n userCertName -r > userCert.bin
Although this sill doesn't seem like the proper command for me. certutil does have an "Add to database" flag, which seems like what I need but it asks for a few things i'm not sure of (the trust for example). My usage of the command was: certutil -A -n ca.pem (which I know is incomplete)
