Re: insecure, convenient use of SSL

[kevin montuori <montuori@gmail.com>]

>>>>> "BM" == Buchan Milne <bgmilne@staff.telkomsa.net> writes:

 >> I'd like to set up LDAP command line tools to point to a server
 >> -- say localhost -- that has a certificate with an arbitrary
 >> name in it -- say `my-domain.com`.

 BM> Either:

 BM> 1)Add an entry to /etc/hosts so that the name on the certificate
 BM> resolves to the correct IP address, and always use the name on
 BM> any connection where you want certificate validation or

 BM> 2)Add TLS_REQCERT allow to the OpenLDAP ldap.conf. If you are
 BM> using anything besides OpenLDAP software (nss_ldap,pam_ldap) be
 BM> aware that their configuration is not identical ...

or, if you can, use the subjectAltName certificate extension.  see the
administrator's guide, 14.1.1.  works as expected and there's no funky
client side configuration required. 


k.

-- 
kevin montuori
montuori@gmail.com