I'm trying to enable SSL connections on an OpenLDAP 2.4.23 server, but all the instructions I find only discuss the old slapd.conf configuration. Can anyone point to some instructions for setting it up under
Here's whats working so far, though I could still use a guide to tuning the security settings under cn=config:
Follow the instructions here to create the certificate, added the tls attributes to cn=config (last two were set by default)
olcTLSCertificateFile /certs/ldapscert.pem olcTLSCertificateKeyFile /certs/keys/ldapskey.pem olcTLSCipherSuite TLSV1+RSA:!NULL olcTLSCRLCheck none olcTLSVerifyClient never
start server using
/usr/local/libexec/slapd -F slapd.d -h ldaps:///
This lets me connect from Apache Directory Studio using ldaps, but isn't working for linux logins.
If, like me, you found this answer but were looking for the dynamic config (cn=config) option, use the following ldif.
dn: cn=config changetype: modify replace: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /path/to/host.key - replace: olcTLSCertificateFile olcTLSCertificateFile: /path/to/host.crt - replace: olcTLSCACertificatePath olcTLSCACertificatePath: /etc/ssl/cert
To add the ldif use:
sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f nameOfLdif.ldif
So it seems that in HA setup you can not use NSS db if you need to update your TLS certificate name. Its not possible to update the name through LDIF with ldapmodify.