Re: [Fedora-directory-users] solaris 10 SSL connections

yah, I wouldn't expect this to help. The file contents have more significance than the file name, and cert8 files aren't identical to cert7. However, I'm not sure this is the problem, since Solaris 10 might be able to use (or even require) cert8 files. All you need in the Solaris client cert db files is the CA certificate of the CA which signed your FDS server's certificate. I'd suggest using the certutil command, rather than Mozilla, to generate the cert db files. The following recipe has worked well for me: ****|# Create new cert and key DB files.|**| certutil -N -d /var/ldap|** *|# Add your ascii CA certificate to the cert DB. certutil -A -n "Susan's CA" -t "C,," -a -i ./susans-cacert.pem -d /var/ldap # List the contents of your cert DB. |***|certutil -L -d /var/ldap|** Try this first using certutil as included with Solaris 10 (/usr/sfw/bin/certutil). I think this will create a cert8 file. If cert8 doesn't seem to work, try generating a cert7 file with an older version of the certutil command. I've found that 3.3.2 is the latest version that will work for the Solaris 8 and 9 ldap name service client: http://www.mozilla.org/projects/security/pki/nss/release_notes_332.html Again, I'm not sure if the cert7/8 version problem is even an issue in Solaris 10, but it certainly is with 8 and 9. -- George Susan wrote: > --- George Holbert <gholbert(a)broadcom.com&gt; wrote: > > >> The ldapsearch command doesn't look in /var/ldap for the cert db. It >> uses the current directory as the default cert db path. >> You can run ldapsearch from /var/ldap, or give it a "-P /var/ldap" >> argument to use the cert db in /var/ldap. >> > > yea, I tried that also, same result. It just doesn't encrypt the connection. > > >> Also, the -v arg might help you narrow down what's happening. >> > > that doesn't add any more info. > > >> by earlier versions of the NSS tools. Solaris 10 might be able to use >> cert8.db. >> > > Now, if I take this exact same command, copy/paste into a linux box (I've to append -x for simple > auth) then voila! it all get scrambled and ethereal says "invalid LDAP header," because it can't > parse SSL on LDAP port. > > So, it looks like FDS is OK but the solaris is no good here... NO IDEA why.. > > George, do you have ssl-enabled solaris ldap auth working with FDS? > > __________________________________________________ > Do You Yahoo!? > Tired of spam? Yahoo! Mail has the best spam protection around > http://mail.yahoo.com > > -- > Fedora-directory-users mailing list > Fedora-directory-users(a)redhat.com > https://www.redhat.com/mailman/listinfo/fedora-directory-users > >