Red Hat DIRECTORY SERVER 7.1 - ADMINISTRATOR Administrator's Manual page 432

Starting the Server with SSL Enabled
By default, this feature is disabled. If it's enabled and if the hostname does not
match the
are logged. For example, in a replicated environment, messages similar to
these are logged in the supplier server's log files if it finds that the peer
server's hostname doesn't match the name specified in its certificate:
It is recommended that you enable this option to protect Directory Server's
outbound SSL connections against a Man in the Middle (MITM) attack.
Check the "Use SSL in the Console" box. Hit "Save."
11.
In the Administration Server Console, select the Configuration tab. Select the
12.
Encryption tab, check the "Enable SSL" checkbox, and fill in the appropriate
certificate information.
In the Configuration DS tab, change the port number to the new Directory
13.
Server secure port information. See "Changing Directory Server Port
Numbers," on page 38, for more information. Do this even if you are using the
default port of
Check the "Secure Connection" checkbox.
In the User DS tab, select the "Set User Directory" radio button, and fill in the
14.
new Directory Server secure port information, the LDAP URL, and the user
database information.
Check the "Secure Connection" checkbox.
Save the new SSL settings, Configuration DS, and User DS information in the
15.
Administration Server.
Restart the Admin Server. You must start the server from the command-line.
16.
Restart the Directory Server. You must start the server from the
17.
command-line.
432 Red Hat Directory Server Administrator's Guide • May 2005
attribute of the certificate, appropriate error and audit messages
cn
[DATE] - SSL alert: ldap_sasl_bind("",LDAP_SASL_EXTERNAL) 81
(Netscape runtime error -12276 - Unable to communicate
securely with peer: requested domain name does not match the
server's certificate.)
[DATE] NSMMReplicationPlugin - agmt="cn=to ultra60 client
auth" (ultra60:1924): Replication bind with SSL client
authentication failed: LDAP error 81 (Can't contact LDAP
server)
.
636