The extracted certificate had "Begin Trusted Certificate" as header. It needed to be "Begin Certificate."
Please note that there are two files at /etc/pki/tls/certs/ -
ca-bundle.crt -> /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
I made the mistake of referring to ca-bundle.trust.crt instead of ca-bundle.crt.
OpenLDAP's slapd simply does not send the certificate chain to clients when TLS handshaking, even if a bundle of server certificate, intermediate certificate has been provided to it as its certificate.
The only suitable work-around without turning certificate validation off on the clients is the following.
create a certificate bundle from intermediate ...
as reference after researching incase someone looking for a self-signed certificate.
creating the key with the following command (Consider Password for Protection)
#openssl genrsa -aes128 -out fd.key 2048
Creating Certificate Signing Requests (CSR)
#openssl req -new -key fd.key -out fd.csr
place the extension information in a separate text file. I’m ...
I think you've misunderstood some terms here, copied from your source
An intermediate certificate authority (CA) is an entity that can sign certificates on behalf of the root CA. The root CA signs the intermediate certificate, forming a chain of trust.
The intermediate certificate SIGNS other certificates, it does not provide the encryption ...
It's been a while since I've been using Let's Encrypt certificates with OpenLDAP, but for me it wasn't necessary to create a file containing a chain. I only have this from my certbot renew-hook script:
cp /etc/letsencrypt/live/$domain/* /etc/ldap/ssl/
chown -R openldap:openldap /etc/ldap/ssl/
chmod 640 /etc/ldap/ssl/*
/etc/init.d/slapd force-reload >/dev/...
I got it working now.
I had 3 approaches and this question was the result of my thirth approach.
Finally I imported the root certificate as IOS profile but I forgot to give trust to it. To do so, I needed to got to settings-> General -> info -> Certificate trust settings (last one) and there I had to enable my root certificate.
@user1686 suggested another solution in https://superuser.com/questions/1599666/view-all-certs-in-a-pem-cert-file-full-cert-chain-with-openssl-or-another-comm
it is part of the GnuTLS stack.
certtool -i < multiplecerts.pem
I can`t comment so I add a separate answer.
I tried to create a self-signed certificate for NGINX and it was easy, but when I wanted to add it to Chrome white list I had a problem. And my solution was to create a Root certificate and signed a child certificate by it.
So step by step.
Create file config_ssl_ca.cnf
Notice, config file has an option ...