Re: OpenLDAP and wildcard SSL certs

[Mike Wisener <mwisener@lurhq.com>]

On Thursday 14 April 2005 11:59, you wrote:
> Thanks for the feedback:
>
> On Thu, Apr 14, 2005 at 11:33:16AM -0400, Mike Wisener wrote:
> > Did you verify the subjectAltName was actually added on your signed
> > certificate? openssl x509 -in <cert> -text
>
> Yes, I did.
>
> > As far as I know, CN should be the fully qualified domain
> > name. subjectAltName should have the wildcard.
>
> But that defeats the whole purpose. Then you'd have to have one cert.
> for each FQDN and then what's the point of using a wildcard at all?
> Or am I misunderstanding what you're saying?

If the hostname you use in ldap://<hostname> matches the CN -- you are good. 

If not, and subjectAltName is present, then <hostname> should be compared to 
values in subjectAltName. 

This is my understanding and as far as I can tell, it works in practice. If 
someone knows there is another way this works, hopefully they will jump in.

Regards,

- Mike

-- 
Mike Wisener, GCIA
Senior Information Security Analyst
LURHQ -- http://www.lurhq.com
mwisener@lurhq.com