From b5d125733bee4d6505e4803df6965d133e043aed Mon Sep 17 00:00:00 2001 From: Amrita Sakthivel Date: Wed, 12 Jul 2023 23:47:07 +0530 Subject: [PATCH] cherry pick of approved content (#1551) --- xml/security_ldap_ca.xml | 91 ++++++++++++++++++++-------------------- 1 file changed, 46 insertions(+), 45 deletions(-) diff --git a/xml/security_ldap_ca.xml b/xml/security_ldap_ca.xml index 6fce5b4713..336839612e 100644 --- a/xml/security_ldap_ca.xml +++ b/xml/security_ldap_ca.xml @@ -5,15 +5,15 @@ %entities; ]> - Importing TLS server certificates and keys - You can manage your CA certificates and keys for &ds389; with the following - command line tools: certutil, openssl, and + You can manage your CA certificates and keys for &ds389; with the following + command line tools: certutil, openssl, and pk12util. @@ -23,62 +23,63 @@ /etc/dirsrv/slapd-INSTANCE-NAME/ca.crt. - For production environments, it is a best practice to use a third-party - certificate authority, such as Let's Encrypt, CAcert.org, SSL.com, or - whatever CA you choose. Request a server certificate, a client + For production environments, it is a best practice to use a third-party + certificate authority, such as Let's Encrypt, CAcert.org, SSL.com, or + whatever CA you choose. Request a server certificate, a client certificate, and a root certificate. - - Before you can import an existing private key and certificate into the NSS - database, you need to create a bundle of the private key and the server - certificate. This results in a *.p12 - file. - - <filename>*.p12</filename> file and friendly name - - When creating the PKCS12 bundle, you must encode Server-Cert - as the friendly name in the *.p12 file. - Otherwise the TLS connection will fail, because the &ds389; searches for - this exact string. - - The friendly name cannot be changed after you - import the *.p12 file into the NSS - database. + The Mozilla NSS (Network Security Services ) toolkit uses nicknames for certificates in the certificate store. + The server certificate uses the nickname Server-Cert. - + - Use the following command to create the PKCS12 bundle with the required friendly name: + Use the following commands to remove the Self-Signed-CA and Server-Cert from the instance: -&prompt.sudo;openssl pkcs12 -export -in SERVER.crt \ --inkey SERVER.key \ --out SERVER.p12 -name Server-Cert +&prompt.sudo;dsctl INSTANCE_NAME tls remove-cert Self-Signed-CA +&prompt.sudo;dsctl INSTANCE_NAME tls remove-cert Server-Cert + + + - Replace SERVER.crt with the server certificate - and SERVER.key with the private key to be bundled. - Use to specify the name of the *.p12 - file. Use to set the friendly name, which must be - Server-Cert. + Replace INSTANCE_NAME with the instance name of the directory server. + This is LDAP1 in the previous sections. - Before you can import the file into the NSS database, you need to - obtain its password. The password is stored in the - pwdfile.txt file in the - /etc/dirsrv/slapd-INSTANCE-NAME/ directory. + Import the CA that has signed your certificate. + &prompt.sudo;sudo dsctl INSTANCE_NAME tls import-ca + /path/to/CA/in/PEM/format/CA.pem NICKNAME_FOR_CA + + +Replace INSTANCE_NAME with the instance name of the directory server. +Replace /path/to/CA/in/PEM/format/CA.pem with the full path to the CA certificate file in the PEM format. +Replace NICKNAME_FOR_CA with a nickname for the CA. - Now import the SERVER.p12 file - into your &ds389a; NSS database: + Import the server certificate and the key for the certificate. - &prompt.sudo;dsctl INSTANCE_NAME tls remove-cert Self-Signed-CA -&prompt.sudo;pk12util -i SERVER.p12 -d /etc/dirsrv/slapd-INSTANCE-NAME/cert9.db - + &prompt.sudo;dsctl INSTANCE_NAME tls import-server-key-cert + /path/to/SERVER.pem /path/to/SERVER.key + + Replace INSTANCE_NAME with the instance name of the directory server. +Replace /path/to/SERVER.pem with the full path to the server certificate in PEM format. +Replace /path/to/SERVER.key with the full path to the server certificate key file in the PEM format. + + + + + Restart the instance so that the new certificates are used. + + &prompt.sudo;systemctl restart dirsrv@INSTANCE-NAME..service + +Replace INSTANCE_NAME with the instance name of the directory server. + - \ No newline at end of file +