Hello,
Le 11/07/2011 22:24, Howard Chu a écrit :
Thibault Le Meur wrote:
Le 11/07/2011 18:29, Rich Megginson a écrit : Not necessarily. When
linked to openssl, openldap used to use the
/etc/openldap/ldap.conf file to read the client-side SSL configuration.
Please open an ITS for this. I'll have to figure out how this was
working in openssl.
Done: ITS#6994
Sounds to me like there's no bug here and the ITS report is invalid.
If you want separate TLS settings for syncrepl you must put them in
the syncrepl directive.
Indeed, there is a new set of TLS parameters that can be given to the
syncrepl processes. However, even when defining the
tls_cacert="/etc/ssl/cacerts/cacert.pem" parameter syncrepl fails to
connect to ldaps:// providers because it still inherits the "client
certs" from the main context.
There is no tls_forget_previous_tls_context parameter so that unless I
try to overwrite the tls_cert and tls_key parameter (something I don't
want to do in my particular setup) I can't get rid of the global TLS
context.
Regards,
Thibault
