Re: [Pki-devel] [PATCH] Allow use of secure LDAPS connection

The code changes look fine. ACK on those. I have some questions about the changes to the man pages. First, as mentioned on #irc, pki_security_domain_password should not be in the example for the default CA case. Now, I think it is important to state the context of this feature in the man page. This could be: * We have a DS that talks LDAPS already, and we need to talk to this DS using LDAPS. It has a CA cert file that is issued by some other CA. * We want to talk to the DS using LDAPS and we want to use the CA cert generated by this CA (once installed) to issue the SSL cert for the DS. We do not need to talk securely during the installation. In this case, you configure the CA using LDAP port first, and then issue a SSL cert for the DS, install and reconfigure the CA. * We have to talk to the DS using LDAPS and we want to use the CA cert for this CA (once installed) to issue the SSL cert for the DS. We also need to be able to talk securely during the installation. In this case, you configure the DS with a temporary self signed cert (as you described in the man page), then install the CA and swap things out post-install. Also, the formatting for man page is a little weird in that the paragraphs following your section on installing using ldaps appear to be part of that section (when they are not). I'm talking about the paragraph that starts: This invocation of pkispawn creates a Tomcat instance containing a CA running on the local machine with secure port 8443 and unsecure port 8080. ... Actually, looking more closely, I think you inserted your section in the wrong place. Ade On Thu, 2015-03-12 at 19:33 -0600, Matthew Harmsen wrote: