11:20 a.m.
Hi,
I'm currently trying to integrate dogtag into our environment :
building did go fine, but somehow it doesn't want to securely connect
to our OpenLDAP server -- that's what I get in the logs at startup :
CMS Warning:
FAILURE: Cannot build CA chain. Error java.security.cert.CertificateException: Certificate
is not a PKCS #11 certificate
FAILURE: In Ldap (bound) connection pool to host ldap.genoscope.cns.fr port 636, Cannot
connect to LDAP server. Error: netscape.ldap.LDAPException: IO Error creating JSS SSL
Socket (-1)
FAILURE: In Ldap (bound) connection pool to host ldap.genoscope.cns.fr port 636, Cannot
connect to LDAP server. Error: netscape.ldap.LDAPException: IO Error creating JSS SSL
Socket (-1)
FAILURE: In Ldap (bound) connection pool to host ldap.genoscope.cns.fr port 636, Cannot
connect to LDAP server. Error: netscape.ldap.LDAPException: IO Error creating JSS SSL
Socket (-1)
FAILURE: authz instance DirAclAuthz initialization failed and skipped, error=Could not
connect to LDAP server host ldap.genoscope.cns.fr port 636 Error
netscape.ldap.LDAPException: IO Error creating JSS SSL Socket (-1)
Google is quite unhelpful on this one, so any hint would be greatly
appreciated.
Simon
11:49 a.m.
Le lundi 06 avril 2009 à 18:20 +0200, Simon Vallet a écrit :
Hi,
I'm currently trying to integrate dogtag into our environment :
building did go fine, but somehow it doesn't want to securely connect
to our OpenLDAP server -- that's what I get in the logs at startup :
CMS Warning:
FAILURE: Cannot build CA chain. Error java.security.cert.CertificateException:
Certificate is not a PKCS #11 certificate
FAILURE: In Ldap (bound) connection pool to host ldap.genoscope.cns.fr port 636, Cannot
connect to LDAP server. Error: netscape.ldap.LDAPException: IO Error creating JSS SSL
Socket (-1)
FAILURE: In Ldap (bound) connection pool to host ldap.genoscope.cns.fr port 636, Cannot
connect to LDAP server. Error: netscape.ldap.LDAPException: IO Error creating JSS SSL
Socket (-1)
FAILURE: In Ldap (bound) connection pool to host ldap.genoscope.cns.fr port 636, Cannot
connect to LDAP server. Error: netscape.ldap.LDAPException: IO Error creating JSS SSL
Socket (-1)
FAILURE: authz instance DirAclAuthz initialization failed and skipped, error=Could not
connect to LDAP server host ldap.genoscope.cns.fr port 636 Error
netscape.ldap.LDAPException: IO Error creating JSS SSL Socket (-1)
Google is quite unhelpful on this one, so any hint would be greatly
appreciated.
Hi Simon,
what are you trying to achieve ?
What are you using OpenLDAP for ? Publishing certs, or config LDAP
server ?
Regards,
J.
--
Jérôme Fenal, RHCE Tel.: +33 1 41 91 23 37
Solution Architect Mob.: +33 6 88 06 51 15
Consultant Avant-ventes Fax.: +33 1 41 91 23 32
http://www.redhat.fr/ jfenal(a)redhat.com
Red Hat France SARL Siret n° 421 199 464 00064
Le Linea, 1 rue du Général Leclerc 92047 Paris La Défense Cédex
Taillez dans vos coûts avec Red Hat ! http://www.redhat.fr/promo/carveoutcosts
11:56 a.m.
Hi Jerôme,
On Mon, 06 Apr 2009 18:49:53 +0200
Jerome Fenal <jfenal(a)redhat.com> wrote:
what are you trying to achieve ?
What are you using OpenLDAP for ? Publishing certs, or config LDAP
server ?
I'm trying to configure it as the "internal database" in the
configuration wizard : "Please provide information to an existing
Fedora Directory Server that can be used as the internal database for
this instance".
Digging a bit further, it seems the PKI CA subsystem doesn't accept the
LDAP server certificate:
No. Time Source
Destination Protocol Info
130 2009-04-06 18:34:20.537435 195.83.222.184
195.83.222.201 TLSv1 Alert (Level: Fatal, Description:
Unknown CA)
Frame 130 (73 bytes on wire, 73 bytes captured)
Ethernet II, Src: SunMicro_9a:98:68 (00:14:4f:9a:98:68), Dst: SunMicro_40:95:14
(00:14:4f:40:95:14)
Internet Protocol, Src: 195.83.222.184 (195.83.222.184), Dst: 195.83.222.201
(195.83.222.201)
Transmission Control Protocol, Src Port: 52794 (52794), Dst Port: ldaps (636), Seq: 73,
Ack: 3441, Len: 7
Secure Socket Layer
TLSv1 Record Layer: Alert (Level: Fatal, Description: Unknown CA)
Content Type: Alert (21)
Version: TLS 1.0 (0x0301)
Length: 2
Alert Message
Level: Fatal (2)
Description: Unknown CA (48)
So I guess I should add this CA as a trusted one in tomcat -- I've
already tried adding it to the default keystore, to no avail. Would I
have missed something ?
Simon
1:59 p.m.
Le lundi 06 avril 2009 à 18:56 +0200, Simon Vallet a écrit :
Hi Jerôme,
On Mon, 06 Apr 2009 18:49:53 +0200
Jerome Fenal <jfenal(a)redhat.com> wrote:
> what are you trying to achieve ?
>
> What are you using OpenLDAP for ? Publishing certs, or config LDAP
> server ?
I'm trying to configure it as the "internal database" in the
configuration wizard : "Please provide information to an existing
Fedora Directory Server that can be used as the internal database for
^^^^^^^^^^^^^^^^^^^^^^^
FDS != OpenLDAP...
this instance".
OpenLDAP is not a supported backend for Dogtag internal database. It may
work (or not), but definitely not supported.
To avoid such hassles, you may want to attend tomorrow's Tech Happy
hours, we'll discuss... Red Hat Certificate System. Fabien is already
scheduled to come, and you'll be welcome as well.
http://www.redhat.fr/events/happy-hour/agenda.php
Regards,
J.
--
Jérôme Fenal, RHCE Tel.: +33 1 41 91 23 37
Solution Architect Mob.: +33 6 88 06 51 15
Consultant Avant-ventes Fax.: +33 1 41 91 23 32
http://www.redhat.fr/ jfenal(a)redhat.com
Red Hat France SARL Siret n° 421 199 464 00064
Le Linea, 1 rue du Général Leclerc 92047 Paris La Défense Cédex
Taillez dans vos coûts avec Red Hat ! http://www.redhat.fr/promo/carveoutcosts
3:06 p.m.
On Mon, 06 Apr 2009 20:59:13 +0200
Jerome Fenal <jfenal(a)redhat.com> wrote:
FDS != OpenLDAP...
OpenLDAP is not a supported backend for Dogtag internal database. It may
work (or not), but definitely not supported.
While certainly aware of that, I'm still interested in a technical
rationale.
To avoid such hassles, you may want to attend tomorrow's Tech
Happy
hours, we'll discuss... Red Hat Certificate System. Fabien is already
scheduled to come, and you'll be welcome as well.
http://www.redhat.fr/events/happy-hour/agenda.php
Unfortunately, such hassles are rarely completely avoidable. I'll
probably attend, though.
Simon
3:58 p.m.
Le lundi 06 avril 2009 à 22:06 +0200, Simon Vallet a écrit :
On Mon, 06 Apr 2009 20:59:13 +0200
Jerome Fenal <jfenal(a)redhat.com> wrote:
> FDS != OpenLDAP...
>
> OpenLDAP is not a supported backend for Dogtag internal database. It may
> work (or not), but definitely not supported.
While certainly aware of that, I'm still interested in a technical
rationale.
OpenLDAP does not support VLV operations, which is needed by the PKI.
Furthermore, this couple (PKI + DS) has been working successfully for
years, QA'd as well, so changing this critical part of the architecture
to lose in functionality would be rewardless.
> To avoid such hassles, you may want to attend tomorrow's
Tech Happy
> hours, we'll discuss... Red Hat Certificate System. Fabien is already
> scheduled to come, and you'll be welcome as well.
> http://www.redhat.fr/events/happy-hour/agenda.php
Unfortunately, such hassles are rarely completely avoidable. I'll
probably attend, though.
See you tomorrow then.
Regards,
J.
--
Jérôme Fenal, RHCE Tel.: +33 1 41 91 23 37
Solution Architect Mob.: +33 6 88 06 51 15
Consultant Avant-ventes Fax.: +33 1 41 91 23 32
http://www.redhat.fr/ jfenal(a)redhat.com
Red Hat France SARL Siret n° 421 199 464 00064
Le Linea, 1 rue du Général Leclerc 92047 Paris La Défense Cédex
Taillez dans vos coûts avec Red Hat ! http://www.redhat.fr/promo/carveoutcosts
5518
days inactive
5518
days old
5 comments
2 participants
participants (2)
-
Jerome Fenal -
Simon Vallet