2

My last SSL certificate expired yesterday and which was configured on my LDAP server, so I purchased a new SSL key activated it and again tried to configure but still it showing the same error. First I tried ldapsearch -d 33 -H ldaps://ldap.example.com -b "dc=example,dc=com" -D "cn=manager,ou=Internal,dc=example,dc=com" -w Zsi9olp4rf8jWi6bmD to connect with server then output was

ldap_url_parse_ext(ldaps://ldap.example.com)
ldap_create
ldap_url_parse_ext(ldaps://ldap.example.com:636/??base)
ldap_sasl_bind
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP ldap.example.com:636
ldap_new_socket: 3
ldap_prepare_socket: 3
ldap_connect_to_host: Trying 10.2.0.102:636
ldap_pvt_connect: fd: 3 tm: -1 async: 0
attempting to connect:
connect success
TLS: certdb config: configDir='/etc/openldap/cacerts' tokenDescription='ldap(0)' certPrefix='' keyPrefix='' flags=readOnly
TLS: using moznss security dir /etc/openldap/cacerts prefix .
TLS: loaded CA certificate file /etc/openldap/cacerts/f96879fa.1.
**TLS: certificate [CN=*.example.com,OU=EssentialSSL Wildcard,OU=Domain Control Validated] is not valid - error -8181:Peer's Certificate has expired..**
TLS: error: connect - force handshake failure: errno 21 - moznss error -8174
TLS: can't connect: TLS error -8174:security library: bad database..
ldap_err2string
**ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)**

So I copied new keys to LDAP server's /etc/openldap/cacerts/cert.pem file but there is an another file /etc/openldap/cacerts/key.pem. Now I'm confused about which file I should add the keys to.

At Clients there are a lot of files in cacerts folder. Please check the attached photos for files.

Client cacerts file

server cacerts file

Please suggest where I need to add new ssl key for proper configuration.

1 Answer 1

1

SSL requires both a private key and a public key. For reasons beyond the scope of this answer, your public key is sent to a Certificate Authority (or CA) in your Certificate Signing Request (CSR) and included in the certificate that comes back to you.

A server needs both the private and public key (almost always wrapped in a certificate) to work. That's why you see two files.

If you generated your new certificate with the same private key, you should be able to replace just the certificate. Most online instructions for creating a CSR also generate a new private key (in the same folder). In that case, you'll need to find and use that private key in conjunction with your certificate.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .