[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
Re: Preliminary TLS/SSL success
John Kristian wrote:
>
> I implemented this, in Netscape Directory Server. Some design choices
> weren't obvious (to me). I'd be happy to tell you what the Netscape software
> does, and why. I've posted some information already; copies are archived at
Thank you for reminding me of this, I am right now working on the part
where
the client presents a certificate and was wondering what to do about it.
For TLS over SASL, there is a clear guide on what is supposed to
happen. But
for the direct LDAP->TLS->TCP thing I was not sure.
> http://www.openldap.org/lists/openldap-devel/9810/msg00074.html
I find the above link particularly interesting. It makes sense and I
was thinking about essentially the same, only was worried about giving
the client certificate verification a meaning that was not warranted.
My purist side warns me that this is not something blessed as a
standard,
but this LDAP over raw TLS is not standard either and the reason to
implement it is purely interoperability with existing implementations.
So existing implementations *are* the definition.
BTW, let me thank you for the pointers you gave about matching rules,
they
were very illuminating in general and, especially, the index management
area.
Julio