[389-users] Re: 389-ds and DNS aliases

Hello,

As described your certificate should be generated with altnames (SAN) to have all DNS names: hostname and alias ....

Best regards

Le dim. 12 févr. 2023 à 08:49, Alberto Crescente <alberto.crescente@pd.infn.it> a écrit :

Hi, I have 3 ldapservers in a multi-master setup for replication with
TLS. TLS is also used in the connection between servers and sssd clients.

The hostnames of the nodes are server1, server2 and server3, so when I
configured the replication agreement I used these names:

Ex:

dsconf LDAP -D "cn=Directory Manager" repl-agmt create
--suffix="dc=example,dc=com" --host="server2.example.com" --port=636
--conn-protocol=LDAPS --bind-dn="cn=replication manager,cn=config"
--bind-passwd="secret" --bind-method=SIMPLE --init
agreement-server1-to-server2

I'd like to use dns aliases instead of server hostnames in the sssd.conf
file on the clients, so that I can replace a server with a new one by
simply changing the alias, without changing the configuration on the
clients.

So I defined aliases auth1, auth2 and auth3 in DNS and used them in
sssd.conf on clients.

With this configuration I have a problem with TLS certificates. If in
the certificate I set the CN equal to the hostname, the sssd clients
give the following error: "TLS: hostname does not match CN", while if I
set the CN equal to the alias name I get a mismatch error in the replica.

Is there a solution to the problem?


Thanks,

Alberto Crescente.
_______________________________________________
389-users mailing list -- 389-users@lists.fedoraproject.org
To unsubscribe send an email to 389-users-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproject.org
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue