Managing Certificates - Sun Microsystems Sun Java SystemDirectory Server Migration Giude

Mapping the Global Configuration
TABLE 6–2
Directory Proxy Server 5 Attribute
ids-proxy-con-ssl-key
ids-proxy-con-ssl-cert
ids-proxy-con-send-cert-as-client
This attribute enables the proxy server to send its
certificate to the LDAP server to allow the LDAP
server to authenticate the proxy server as an SSL
client.
ids-proxy-con-server-ssl-version
ids-proxy-con-client-ssl-version
ids-proxy-con-ssl-cert-required
ids-proxy-con-ssl-cafile

Managing Certificates

Directory Proxy Server 5, certificates were managed by using the certreq utility, or by using the
console. In Directory Proxy Server 6.0, certificates are managed by using the dpadm command,
or by using the DSCC.
Certificates must be installed on each individual data source in Directory Proxy Server 6.0.
For information about managing certificates in Directory Proxy Server 6.0, see Chapter 19,
"Directory Proxy Server Certificates, " in Sun Java System Directory Server Enterprise Edition 6.0
Administration Guide.
Access Control on the Proxy Configuration
In Directory Proxy Server 5, access control on the proxy configuration is managed by ACIs in
the configuration directory server. In Directory Proxy Server 6.0, access to the configuration file
is restricted to the person who created the proxy instance, or to the proxy manager if the
configuration is accessed through Directory Proxy Server. Editing the configuration file directly
is not supported.
86 Sun Java System Directory Server Enterprise Edition 6.0 Migration Guide • March 2007
Mapping of Security Configuration
Sun Confidential: Registered
Directory Proxy Server 6.0 Property
ssl-key-pin
ssl-certificate-directory
ssl-server-cert-alias
ssl-client-cert-alias
This property enables the proxy server to send a different
certificate to the LDAP server, depending on whether it is
acting as an SSL Server or an SSL Client.
No equivalent
This feature can be achieved by setting the following
server property:
$ dpconf set-server-prop
allow-cert-based-auth:require
No equivalent