配置openldap支持SSL连接
这里使用openssl自带的CA脚本创建证书
一、创建CA certificate
# mkdir -p /root/myca/tls/misc
# cp /etc/pki/tls/misc/CA /root/myca/tls/misc/CA
# cd /root/myca/tls/misc/
[root@localhost misc]# ./CA -newca
CA certificate filename (or enter to create)
[回车]
Making CA certificate ...
Generating a 1024 bit RSA private key
........................++++++
.++++++
writing new private key to '../../CA/private/./cakey.pem'
Enter PEM pass phrase:123456
Verifying - Enter PEM pass phrase:123456
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]: [回车]
State or Province Name (full name) [Berkshire]: [回车]
Locality Name (eg, city) [Newbury]: [回车]
Organization Name (eg, company) [My Company Ltd]: [回车]
Organizational Unit Name (eg, section) []:[回车]
Common Name (eg, your name or your server's hostname) []:zhangyang
Email Address []:[email protected]
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:654321
An optional company name []:[回车]
Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for ../../CA/private/./cakey.pem:123456
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 0 (0x0)
Validity
Not Before: Nov 22 13:57:52 2009 GMT
Not After : Nov 21 13:57:52 2012 GMT
Subject:
countryName = GB
stateOrProvinceName = Berkshire
organizationName = My Company Ltd
commonName = zhangyang
emailAddress = [email protected]
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
CD:CF:B3:AC:17:42:96:68:0B:27:E2:50:99:CA:89:B3:1B:58:1E:2C
X509v3 Authority Key Identifier:
keyid:CD:CF:B3:AC:17:42:96:68:0B:27:E2:50:99:CA:89:B3:1B:58:1E:2C
Certificate is to be certified until Nov 21 13:57:52 2012 GMT (1095 days)
Write out database with 1 new entries
Data Base Updated
[root@localhost misc]# ls ../../CA
cacert.pem certs index.txt index.txt.old private serial.old
careq.pem crl index.txt.attr newcerts serial
二、创建服务器证书请求和私钥
[root@localhost misc]# openssl req -new -nodes -keyout newkey.pem -out newreq.pem
Generating a 1024 bit RSA private key
...............................................++++++
.........................................................................++++++
writing new private key to 'newkey.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]: [回车]
State or Province Name (full name) [Berkshire]: [回车]
Locality Name (eg, city) [Newbury]: [回车]
Organization Name (eg, company) [My Company Ltd]: [回车]
Organizational Unit Name (eg, section) []:[回车]
Common Name (eg, your name or your server's hostname) []:zy.net
Email Address []:[回车]
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:456789
An optional company name []:[回车]
[root@localhost misc]# ls
CA newkey.pem newreq.pem
***********************************************************
三、为服务器证书请求签名并生成证书
[root@localhost misc]# ./CA -sign
Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for ../../CA/private/cakey.pem:123456
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: Nov 22 14:08:10 2009 GMT
Not After : Nov 22 14:08:10 2010 GMT
Subject:
countryName = GB
stateOrProvinceName = Berkshire
localityName = Newbury
organizationName = My Company Ltd
commonName = zy.net
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
A8:11:C9:E7:5D:A8:41:87:07:AE:96:F2:7B:1C:B7:38:ED:A5:1E:1C
X509v3 Authority Key Identifier:
keyid:CD:CF:B3:AC:17:42:96:68:0B:27:E2:50:99:CA:89:B3:1B:58:1E:2C
Certificate is to be certified until Nov 22 14:08:10 2010 GMT (365 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 1 (0x1)
Signature Algorithm: sha1WithRSAEncryption
Issuer: C=GB, ST=Berkshire, O=My Company Ltd, CN=zhangyang/[email protected]
Validity
Not Before: Nov 22 14:08:10 2009 GMT
Not After : Nov 22 14:08:10 2010 GMT
Subject: C=GB, ST=Berkshire, L=Newbury, O=My Company Ltd, CN=zy.net
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public Key: (1024 bit)
Modulus (1024 bit):
00:d3:5f:9e:13:df:a6:4a:3e:7a:d3:0d:61:b4:41:
eb:a8:61:a5:67:15:9c:04:e9:7e:a8:82:22:16:d4:
82:a5:53:d4:f1:51:7c:43:78:57:aa:b7:86:7c:cd:
a7:6c:bb:19:d6:91:14:ff:5e:f0:f2:d1:fb:8e:ab:
71:1c:72:4a:0e:d4:ea:7b:a3:a7:77:9e:b2:31:cb:
b2:18:93:41:48:ac:11:c7:f5:0e:3e:18:d7:12:cf:
e3:77:e3:14:fb:bd:ad:bb:da:03:84:dc:83:3e:15:
64:7c:87:26:bb:c0:5e:9f:16:91:36:c6:53:69:5e:
ed:96:64:67:47:a1:18:c1:51
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
A8:11:C9:E7:5D:A8:41:87:07:AE:96:F2:7B:1C:B7:38:ED:A5:1E:1C
X509v3 Authority Key Identifier:
keyid:CD:CF:B3:AC:17:42:96:68:0B:27:E2:50:99:CA:89:B3:1B:58:1E:2C
Signature Algorithm: sha1WithRSAEncryption
0e:de:0c:86:25:85:c9:4e:c9:cf:90:7c:06:18:88:b8:34:de:
d8:bf:5b:8b:5d:a8:c5:17:4d:b4:84:38:fd:10:99:43:b0:f8:
b5:f6:58:a5:36:36:66:bc:81:de:a6:19:8c:a5:cf:f5:f5:aa:
a5:5f:a3:55:cb:9d:28:36:3c:2e:96:38:d8:65:8b:df:93:f9:
6d:92:a0:47:47:a2:f5:5b:24:cf:46:42:16:2a:d4:5b:83:9e:
a3:29:c8:12:e7:08:88:44:1f:33:16:18:4b:90:1b:45:55:76:
5d:a2:9b:db:25:90:1f:32:f8:52:81:00:a3:da:fa:fb:88:cf:
5e:51
-----BEGIN CERTIFICATE-----
MIICwjCCAiugAwIBAgIBATANBgkqhkiG9w0BAQUFADB0MQswCQYDVQQGEwJHQjES
MBAGA1UECBMJQmVya3NoaXJlMRcwFQYDVQQKEw5NeSBDb21wYW55IEx0ZDESMBAG
A1UEAxMJemhhbmd5YW5nMSQwIgYJKoZIhvcNAQkBFhV6aGFuZ3lhbmcwNDAyQHRv
bS5jb20wHhcNMDkxMTIyMTQwODEwWhcNMTAxMTIyMTQwODEwWjBdMQswCQYDVQQG
EwJHQjESMBAGA1UECBMJQmVya3NoaXJlMRAwDgYDVQQHEwdOZXdidXJ5MRcwFQYD
VQQKEw5NeSBDb21wYW55IEx0ZDEPMA0GA1UEAxMGenkubmV0MIGfMA0GCSqGSIb3
DQEBAQUAA4GNADCBiQKBgQDTX54T36ZKPnrTDWG0QeuoYaVnFZwE6X6ogiIW1IKl
U9TxUXxDeFeqt4Z8zadsuxnWkRT/XvDy0fuOq3EcckoO1Op7o6d3nrIxy7IYk0FI
rBHH9Q4+GNcSz+N34xT7va272gOE3IM+FWR8hya7wF6fFpE2xlNpXu2WZGdHoRjB
UQIDAQABo3sweTAJBgNVHRMEAjAAMCwGCWCGSAGG+EIBDQQfFh1PcGVuU1NMIEdl
bmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUqBHJ512oQYcHrpbyexy3OO2l
HhwwHwYDVR0jBBgwFoAUzc+zrBdClmgLJ+JQmcqJsxtYHiwwDQYJKoZIhvcNAQEF
BQADgYEADt4MhiWFyU7Jz5B8BhiIuDTe2L9bi12oxRdNtIQ4/RCZQ7D4tfZYpTY2
ZryB3qYZjKXP9fWqpV+jVcudKDY8LpY42GWL35P5bZKgR0ei9Vskz0ZCFirUW4Oe
oynIEucIiEQfMxYYS5AbRVV2XaKb2yWQHzL4UoEAo9r6+4jPXlE=
-----END CERTIFICATE-----
Signed certificate is in newcert.pem
[root@localhost misc]# ls
CA newcert.pem newkey.pem newreq.pem
四、将CA证书、服务器证书和私钥拷贝到指定目录
[root@localhost misc]# cp ../../CA/cacert.pem /etc/openldap/cacerts/cacert.pem
[root@localhost misc]# cp newcert.pem /etc/openldap/cacerts/servercert.pem
[root@localhost misc]# cp newkey.pem /etc/openldap/cacerts/serverkey.pem
五、在slapd.conf中启用SSL/TLS:
ssl start_tls
TLSCACertificateFile ./cacerts/cacert.pem
TLSCertificateFile ./cacerts/servercert.pem
TLSCertificateKeyFile ./cacerts/serverkey.pem
重新启动slapd :
slapd -h "ldap:/// ldaps:///"
在636端口监听SSL连接
六、测试
打开JXplorer， 使用SSL+Anonymous方式登录，可看到一证书警告对话框出现。