On Sat, 13 May 2006 22:53:21 -0300 "Francisco Saito" <[EMAIL PROTECTED]> wrote:
> Add a clausule: > tls=critical after bindmethod=simple credentials=secret It seems to refuse the SSLv3 cert. All I need is a root-cert on both machines (for the the master in ldap.conf) and a cert/key-pair signed by that root-cert on the slave? Or have I missed something somewhere? R. > On 5/13/06, richard lucassen <[EMAIL PROTECTED]> wrote: > > > > Hello list, > > > > Using version 2.2.23 (Debian Sarge) with slurpd-replication, I see > > that the certificates are exchanged and replication works, but the > > replicator's username/pass is passing cleartext over the line. > > > > -- master slapd.conf: > > replica uri=ldap://ldapslave.example.com starttls=yes > > binddn=cn=replicator,dc=example,dc=com > > bindmethod=simple credentials=secret > > > > -- master ldap.conf: > > TLS_CACERT /etc/ldap/cacert.crt > > > > > > -- slave slapd.conf > > TLSCACertificateFile /etc/ldap/cacert.crt > > TLSCertificateFile /etc/ldap/ldapslave.example.com-cert.pem > > TLSCertificateKeyFile /etc/ldap/ldapslave.example.com-key.pem > > > > When connecting to the servers (master and slave) with gq, tls is > > working. Anyone a hint? > > > > Richard. > > > > -- > > ___________________________________________________________________ > > It is better to remain silent and be thought a fool, than to speak > > aloud and remove all doubt. > > > > +------------------------------------------------------------------+ > > | Richard Lucassen, Utrecht | > > | Public key and email address: | > > | http://www.lucassen.org/mail-pubkey.html | > > +------------------------------------------------------------------+ > > > > -- ___________________________________________________________________ It is better to remain silent and be thought a fool, than to speak aloud and remove all doubt. +------------------------------------------------------------------+ | Richard Lucassen, Utrecht | | Public key and email address: | | http://www.lucassen.org/mail-pubkey.html | +------------------------------------------------------------------+
