Red Hat DIRECTORY SERVER 7.1 - ADMINISTRATOR Administrator's Manual page 438

Configuring LDAP Clients to Use SSL
These operations are sufficient if you want to ensure that LDAP clients recognize
the server's certificate. However, if you also want LDAP clients to use their own
certificate to authenticate to the directory, make sure that all your directory users
obtain and install a personal certificate.
NOTE
On the client system, obtain a client certificate from the CA.
1.
On your client system, install your client certificate.
2.
Regardless of how you receive your certificate (either in email or on a web
page), there should be a link that you click to install the certificate.
Make sure you record the certificate information that is sent to you in a file. In
particular, you must know the subject DN of the certificate because you must
configure the server to map it to an entry in the directory. Your client
certificate will be similar to:
-----BEGIN CERTIFICATE-----
MIICMjCCAZugAwIBAgICCEEwDQYJKoZIhvcNAQEFBQAwfDELMAkGA1UEBh
MCVVMxIzAhBgNVBAoTGlBhbG9va2FWaWxsZSBXaWRnZXRzLCBJbmMuMR0w
GwYDVQQLExRXaWRnZXQgTWFrZXJzICdSJyBVczEpMCcGA1UEAxMgVGVzdC
BUZXN0IFRlc3QgVGVzdCBUZXN0IFRlc3QgQ0EwHhcNOTgwMzEyMDIzMzU3
WhcNOTgwMzI2MDIzMzU3WjBPMQswCQYDVQQGEwJVUzEoMCYGA1UEChMfTm
V0c2NhcGUgRGlyZWN0b3
-----END CERTIFICATE-----
You must convert the client certificate into its binary format using the
3.
certutil
where
name you gave to your certificate when you installed it, and
name you must specify for the output file that will contain the certificate in
the binary format.
On the server, map the subject DN of the certificate that you obtained to the
4.
appropriate directory entry by editing the
This procedure is described in Managing Servers with Red Hat Console.
438 Red Hat Directory Server Administrator's Guide • May 2005
Some client applications do not verify that the server has a trusted
certificate.
utility. To do this:
certutil -L -d certdbPath -n userCertName -r > userCert.bin
is the location of your certificate database,
certdbPath userCertName
userCert.bin
file.
certmap.conf
is the
is the