I'm trying to add a new server, and will need to use SSL, of course. But all the instructions tell how to generate a self-signed CA, but we've got real signed certs on the other servers, and so I'm trying to generate a CSR for the new one. Generating one from the 389-console is only giving me a 1024-bit key, and 2048 is required. I see that running the cert request from the command line is not the preferred option, but how else can I change the parameters for the cert request? Thanks, Addison -- 389 users mailing list 389-users(a)lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/389-users

Never knew command line is frowned upon. I used command line to generate my cert requests as well since the gui can't do things like SAN. Haven't had any issues generating my certreqs that way. Once the certificate comes back I use the gui to import. -----Original Message----- From: 389-users-bounces(a)lists.fedoraproject.org [mailto:389-users-bounces@lists.fedoraproject.org] On Behalf Of Addison Laurent Sent: Monday, May 07, 2012 12:13 PM To: 389-users(a)lists.fedoraproject.org Subject: [389-users] How to change certificate options using 389-console ? I'm trying to add a new server, and will need to use SSL, of course. But all the instructions tell how to generate a self-signed CA, but we've got real signed certs on the other servers, and so I'm trying to generate a CSR for the new one. Generating one from the 389-console is only giving me a 1024-bit key, and 2048 is required. I see that running the cert request from the command line is not the preferred option, but how else can I change the parameters for the cert request? Thanks, Addison -- 389 users mailing list 389-users(a)lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/389-users This communication, including any attached documentation, is intended only for the person or entity to which it is addressed, and may contain confidential, personal and/or privileged information. Any unauthorized disclosure, copying, or taking action on the contents is strictly prohibited. If you have received this message in error, please contact us immediately so we may correct our records. Please then delete or destroy the original transmission and any subsequent reply. -- 389 users mailing list 389-users(a)lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/389-users

Hie On Mon, May 7, 2012 at 11:42 PM, Addison Laurent <alaurent(a)cise.ufl.edu&gt;wrote: > Generating one from the 389-console is only giving me a 1024-bit key, > and 2048 is required. > > In order to generate a 2048-bit ASCII certificate request, certain options must be specified as seen in the example below: # certutil -R -d /database/directory/ -s "cn=myhost.example.com,dc=myorg,dc=com" -a -g 2048

On Tue, May 8, 2012 at 9:20 AM, <alaurent(a)cise.ufl.edu&gt; wrote: > > On Mon, May 7, 2012 at 11:42 PM, Addison Laurent > > <alaurent(a)cise.ufl.edu&gt;wrote: > >> Generating one from the 389-console is only giving me a 1024-bit key, > >> and 2048 is required. > >> > >> In order to generate a 2048-bit ASCII certificate request, certain > > options must be specified as seen in the example below: > > > > # certutil -R -d /database/directory/ -s > > "cn=myhost.example.com,dc=myorg,dc=com" -a -g 2048 > > Right. So 389-console cannot generate the keys that are required today > for non-self-signed? > > It can, but you cant give the key size in console, It will stick to default 1024.