dogtag can't establish SSL connection to LDAP server
Hi, I'm currently trying to integrate dogtag into our environment : building did go fine, but somehow it doesn't want to securely connect to our OpenLDAP server -- that's what I get in the logs at startup : CMS Warning: FAILURE: Cannot build CA chain. Error java.security.cert.CertificateException: Certificate is not a PKCS #11 certificate FAILURE: In Ldap (bound) connection pool to host ldap.genoscope.cns.fr port 636, Cannot connect to LDAP server. Error: netscape.ldap.LDAPException: IO Error creating JSS SSL Socket (-1) FAILURE: In Ldap (bound) connection pool to host ldap.genoscope.cns.fr port 636, Cannot connect to LDAP server. Error: netscape.ldap.LDAPException: IO Error creating JSS SSL Socket (-1) FAILURE: In Ldap (bound) connection pool to host ldap.genoscope.cns.fr port 636, Cannot connect to LDAP server. Error: netscape.ldap.LDAPException: IO Error creating JSS SSL Socket (-1) FAILURE: authz instance DirAclAuthz initialization failed and skipped, error=Could not connect to LDAP server host ldap.genoscope.cns.fr port 636 Error netscape.ldap.LDAPException: IO Error creating JSS SSL Socket (-1) Google is quite unhelpful on this one, so any hint would be greatly appreciated. Simon
Le lundi 06 avril 2009 à 18:20 +0200, Simon Vallet a écrit :
Hi,
I'm currently trying to integrate dogtag into our environment : building did go fine, but somehow it doesn't want to securely connect to our OpenLDAP server -- that's what I get in the logs at startup :
CMS Warning: FAILURE: Cannot build CA chain. Error java.security.cert.CertificateException: Certificate is not a PKCS #11 certificate FAILURE: In Ldap (bound) connection pool to host ldap.genoscope.cns.fr port 636, Cannot connect to LDAP server. Error: netscape.ldap.LDAPException: IO Error creating JSS SSL Socket (-1) FAILURE: In Ldap (bound) connection pool to host ldap.genoscope.cns.fr port 636, Cannot connect to LDAP server. Error: netscape.ldap.LDAPException: IO Error creating JSS SSL Socket (-1) FAILURE: In Ldap (bound) connection pool to host ldap.genoscope.cns.fr port 636, Cannot connect to LDAP server. Error: netscape.ldap.LDAPException: IO Error creating JSS SSL Socket (-1) FAILURE: authz instance DirAclAuthz initialization failed and skipped, error=Could not connect to LDAP server host ldap.genoscope.cns.fr port 636 Error netscape.ldap.LDAPException: IO Error creating JSS SSL Socket (-1)
Google is quite unhelpful on this one, so any hint would be greatly appreciated.
Hi Simon, what are you trying to achieve ? What are you using OpenLDAP for ? Publishing certs, or config LDAP server ? Regards, J. -- Jérôme Fenal, RHCE Tel.: +33 1 41 91 23 37 Solution Architect Mob.: +33 6 88 06 51 15 Consultant Avant-ventes Fax.: +33 1 41 91 23 32 http://www.redhat.fr/ jfenal@redhat.com Red Hat France SARL Siret n° 421 199 464 00064 Le Linea, 1 rue du Général Leclerc 92047 Paris La Défense Cédex Taillez dans vos coûts avec Red Hat ! http://www.redhat.fr/promo/carveoutcosts
Hi Jerôme, On Mon, 06 Apr 2009 18:49:53 +0200 Jerome Fenal <jfenal@redhat.com> wrote:
what are you trying to achieve ?
What are you using OpenLDAP for ? Publishing certs, or config LDAP server ?
I'm trying to configure it as the "internal database" in the configuration wizard : "Please provide information to an existing Fedora Directory Server that can be used as the internal database for this instance". Digging a bit further, it seems the PKI CA subsystem doesn't accept the LDAP server certificate: No. Time Source Destination Protocol Info 130 2009-04-06 18:34:20.537435 195.83.222.184 195.83.222.201 TLSv1 Alert (Level: Fatal, Description: Unknown CA) Frame 130 (73 bytes on wire, 73 bytes captured) Ethernet II, Src: SunMicro_9a:98:68 (00:14:4f:9a:98:68), Dst: SunMicro_40:95:14 (00:14:4f:40:95:14) Internet Protocol, Src: 195.83.222.184 (195.83.222.184), Dst: 195.83.222.201 (195.83.222.201) Transmission Control Protocol, Src Port: 52794 (52794), Dst Port: ldaps (636), Seq: 73, Ack: 3441, Len: 7 Secure Socket Layer TLSv1 Record Layer: Alert (Level: Fatal, Description: Unknown CA) Content Type: Alert (21) Version: TLS 1.0 (0x0301) Length: 2 Alert Message Level: Fatal (2) Description: Unknown CA (48) So I guess I should add this CA as a trusted one in tomcat -- I've already tried adding it to the default keystore, to no avail. Would I have missed something ? Simon
Le lundi 06 avril 2009 à 18:56 +0200, Simon Vallet a écrit :
Hi Jerôme,
On Mon, 06 Apr 2009 18:49:53 +0200 Jerome Fenal <jfenal@redhat.com> wrote:
what are you trying to achieve ?
What are you using OpenLDAP for ? Publishing certs, or config LDAP server ?
I'm trying to configure it as the "internal database" in the configuration wizard : "Please provide information to an existing Fedora Directory Server that can be used as the internal database for ^^^^^^^^^^^^^^^^^^^^^^^ FDS != OpenLDAP...
this instance".
OpenLDAP is not a supported backend for Dogtag internal database. It may work (or not), but definitely not supported. To avoid such hassles, you may want to attend tomorrow's Tech Happy hours, we'll discuss... Red Hat Certificate System. Fabien is already scheduled to come, and you'll be welcome as well. http://www.redhat.fr/events/happy-hour/agenda.php Regards, J. -- Jérôme Fenal, RHCE Tel.: +33 1 41 91 23 37 Solution Architect Mob.: +33 6 88 06 51 15 Consultant Avant-ventes Fax.: +33 1 41 91 23 32 http://www.redhat.fr/ jfenal@redhat.com Red Hat France SARL Siret n° 421 199 464 00064 Le Linea, 1 rue du Général Leclerc 92047 Paris La Défense Cédex Taillez dans vos coûts avec Red Hat ! http://www.redhat.fr/promo/carveoutcosts
On Mon, 06 Apr 2009 20:59:13 +0200 Jerome Fenal <jfenal@redhat.com> wrote:
FDS != OpenLDAP...
OpenLDAP is not a supported backend for Dogtag internal database. It may work (or not), but definitely not supported.
While certainly aware of that, I'm still interested in a technical rationale.
To avoid such hassles, you may want to attend tomorrow's Tech Happy hours, we'll discuss... Red Hat Certificate System. Fabien is already scheduled to come, and you'll be welcome as well. http://www.redhat.fr/events/happy-hour/agenda.php
Unfortunately, such hassles are rarely completely avoidable. I'll probably attend, though. Simon
Le lundi 06 avril 2009 à 22:06 +0200, Simon Vallet a écrit :
On Mon, 06 Apr 2009 20:59:13 +0200 Jerome Fenal <jfenal@redhat.com> wrote:
FDS != OpenLDAP...
OpenLDAP is not a supported backend for Dogtag internal database. It may work (or not), but definitely not supported.
While certainly aware of that, I'm still interested in a technical rationale.
OpenLDAP does not support VLV operations, which is needed by the PKI. Furthermore, this couple (PKI + DS) has been working successfully for years, QA'd as well, so changing this critical part of the architecture to lose in functionality would be rewardless.
To avoid such hassles, you may want to attend tomorrow's Tech Happy hours, we'll discuss... Red Hat Certificate System. Fabien is already scheduled to come, and you'll be welcome as well. http://www.redhat.fr/events/happy-hour/agenda.php
Unfortunately, such hassles are rarely completely avoidable. I'll probably attend, though.
See you tomorrow then. Regards, J. -- Jérôme Fenal, RHCE Tel.: +33 1 41 91 23 37 Solution Architect Mob.: +33 6 88 06 51 15 Consultant Avant-ventes Fax.: +33 1 41 91 23 32 http://www.redhat.fr/ jfenal@redhat.com Red Hat France SARL Siret n° 421 199 464 00064 Le Linea, 1 rue du Général Leclerc 92047 Paris La Défense Cédex Taillez dans vos coûts avec Red Hat ! http://www.redhat.fr/promo/carveoutcosts
participants (2)
-
Jerome Fenal -
Simon Vallet