[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
Re: LDAP and SSL
On Sun, 28 Nov 2004 20:33:38 -0500 (EST), Steve Revilak
<srevilak@speakeasy.net> wrote:
> This seems to indicate that `newcert.pem' does not contain an rsa key.
> pem's are just text files. An rsa key will look like this:
>
> -----BEGIN RSA PRIVATE KEY-----
> [base64 encoded representation of rsa key]
> -----END RSA PRIVATE KEY-----
>
> While not specific to openldap software, the mod_ssl folks have a nice
> set of how-to's for working with ssl certificates:
>
> http://www.modssl.org/docs/2.8/ssl_faq.html#ToC24
I was under the impression that OpenLDAP didnt support encrypted keys?
Is this not the proper procedure:
CA.sh -newca
openssl req -new -nodes -keyout newreq.pem -out newreq.pem
CA.sh -sign
CA.sh -verify
etc ... etc
(Like its documented on OpenLDAP SSL FAQ?)
So far I am at this point (testing with Mozilla and my cacert.der installed.)
s_server -accept 390 -cert /etc/ldap/servercrt.pem -key
/etc/ldap/serverkey.pem -CAfile /etc/ldap/cacert.pem -www
Ciphers supported in s_server binary
TLSv1/SSLv3:DHE-RSA-AES256-SHA TLSv1/SSLv3:DHE-DSS-AES256-SHA
TLSv1/SSLv3:AES256-SHA TLSv1/SSLv3:EDH-RSA-DES-CBC3-SHA
TLSv1/SSLv3:EDH-DSS-DES-CBC3-SHA TLSv1/SSLv3:DES-CBC3-SHA
SSLv2 :DES-CBC3-MD5 TLSv1/SSLv3:DHE-RSA-AES128-SHA
TLSv1/SSLv3:DHE-DSS-AES128-SHA TLSv1/SSLv3:AES128-SHA
SSLv2 :RC2-CBC-MD5 TLSv1/SSLv3:DHE-DSS-RC4-SHA
TLSv1/SSLv3:RC4-SHA TLSv1/SSLv3:RC4-MD5
SSLv2 :RC4-MD5 SSLv2 :RC4-64-MD5
TLSv1/SSLv3:EXP1024-DHE-DSS-DES-CBC-SHATLSv1/SSLv3:EXP1024-DES-CBC-SHA
TLSv1/SSLv3:EXP1024-RC2-CBC-MD5 TLSv1/SSLv3:EDH-RSA-DES-CBC-SHA
TLSv1/SSLv3:EDH-DSS-DES-CBC-SHA TLSv1/SSLv3:DES-CBC-SHA
SSLv2 :DES-CBC-MD5 TLSv1/SSLv3:EXP1024-DHE-DSS-RC4-SHA
TLSv1/SSLv3:EXP1024-RC4-SHA TLSv1/SSLv3:EXP1024-RC4-MD5
TLSv1/SSLv3:EXP-EDH-RSA-DES-CBC-SHA TLSv1/SSLv3:EXP-EDH-DSS-DES-CBC-SHA
TLSv1/SSLv3:EXP-DES-CBC-SHA TLSv1/SSLv3:EXP-RC2-CBC-MD5
SSLv2 :EXP-RC2-CBC-MD5 TLSv1/SSLv3:EXP-RC4-MD5
SSLv2 :EXP-RC4-MD5
---
Ciphers common between both SSL end points:
DHE-RSA-AES256-SHA DHE-DSS-AES256-SHA AES256-SHA
DHE-RSA-AES128-SHA DHE-DSS-AES128-SHA RC4-MD5
RC4-SHA AES128-SHA EDH-RSA-DES-CBC3-SHA
EDH-DSS-DES-CBC3-SHA DES-CBC3-SHA EDH-RSA-DES-CBC-SHA
EDH-DSS-DES-CBC-SHA DES-CBC-SHA EXP1024-RC4-SHA
EXP1024-DES-CBC-SHA EXP-RC4-MD5 EXP-RC2-CBC-MD5
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
SSL-Session:
Protocol : TLSv1
Cipher : DHE-RSA-AES256-SHA
Session-ID: E90A6F64F4F58CF4A61B87FCF20640AE2CCBBD746567C48FCCF089122D1D7938
Session-ID-ctx: 00000001
Master-Key:
15E8E6C37D8ED68693BAEAC64680828EC0AB2E530CF56309E2B9352F42C798D9A6ABBD8ABF978ABA1601E634054D7DBA
Key-Arg : None
Start Time: 1101747594
Timeout : 300 (sec)
Verify return code: 0 (ok)
---
3 items in the session cache
0 client connects (SSL_connect())
0 client renegotiates (SSL_connect())
0 client connects that finished
5 server accepts (SSL_accept())
0 server renegotiates (SSL_accept())
4 server accepts that finished
1 session cache hits
0 session cache misses
0 session cache timeouts
0 callback cache hits
0 cache full overflows (128 allowed)
---
no client certificate available
No errors on reported on the server side.
Does that mean I am even on the right track?
I would be more than happy to try anything those with more expereince
in this matter would direct me in testing.
--
WC -Sx- Jones
http://insecurity.org/