5.5 Configuring SSL Connections

The driver uses the LDAP protocol to communicate with the LDAP server. Most LDAP servers allow non-encrypted (clear-text) connections. Additionally, when configured correctly, some LDAP servers allow SSL-encrypted connections. SSL connections encrypt all traffic on the TCP/IP socket by using a public/private key pair. The actual LDAP protocol doesn’t change, but the communication channel performs the encryption.

The procedure for enabling SSL connections differs slightly from one LDAP server to another. This document covers the process for enabling SSL connections when using Netscape Directory Server 4.12.

If you are using another LDAP server, the procedure is similar.

5.5.1 Step 1: Generating a Server Certificate

You first need to install a server certificate. The LDAP server itself can generate a certificate, but the certificate must then be signed by a CA that is trusted by the server. One way to get the certificate signed is to use the CA that comes with an Identity Vault.

To generate a certificate request:

  1. In the navigation tree in Netscape Console, select the server that the driver will communicate with.

  2. Click Open Server.

  3. Click Tasks > Certificate Setup Wizard.

  4. Provide information to request a certificate.

    Depending on the certificates or tokens that might already be installed on the host system, you might see some or all of the following fields:

    Select a Token (Cryptographic Device): Select Internal (Software).

    Is the Server Certificate Already Requested and Ready to Install? Select No.

    If a trust database doesn’t already exist for this host, one is generated for you.

    A trust database is a key pair and certificate database installed on the local host. When you use an internal token, the trust database is the database into which you install the key and certificate.

  5. Type and confirm the password.

    The password must contain at least eight characters, and at least one of them must be numeric. This password helps secure access to the new key database you’re creating.

  6. Continue providing information as prompted, then click Next.

  7. After a trust database is created, click Next.

  8. Type the requested information, then click Next.

  9. Type the password for the token you selected earlier, then click Next.

    The Certificate Setup Wizard generates a certificate request for your server. When you see the page, you can send the certificate request to the certification authority.

  10. Continue with Step 2: Sending the Certificate Request.

5.5.2 Step 2: Sending the Certificate Request

  1. Copy the server certificate request into Notepad or another text editor.

  2. Save the file as csr.txt.

    Your certificate request e-mail should look like the following:

    -----BEGIN NEW CERTIFICATE REQUEST-----

        . 

        . 

        . 
-----END NEW CERTIFICATE REQUEST----

  3. In iManager, select Novell Certificate Server > Issue Certificate.

  4. In the Filename field, browse to csr.txt, then click Next.

  5. Select Organizational Certificate Authority.

  6. Specify SSL as the key type, then click Next.

  7. Specify the certificate parameters, click Next, then click Finish.

  8. Save the certificate in Base64 format as cert.b64 to a local disk or diskette.

  9. Continue with Step 3: Installing the Certificate.

5.5.3 Step 3: Installing the Certificate

  1. In the navigation tree in Netscape Console, select the server that the driver will be connecting to.

  2. Click Open.

  3. Click Tasks > Certificate Setup Wizard.

  4. Start the wizard and indicate that you are ready to install the certificate.

  5. When prompted, provide the following information:

    Select a Token (Cryptographic Device): Select Internal (Software).

    Is the Server Certificate Already Requested and Ready to Install? Select Yes.

  6. Click Next.

  7. In the Install Certificate For field, select This Server.

  8. In the Password field, type the password you used to set up the trust database, then click Next.

  9. In the Certificate Is Located in This File field, type the absolute path to the certificate (for example, A: \CERT.B64).

  10. After the certificate is generated, click Add.

  11. After the certificate is successfully installed, click Done.

  12. Continue with Step 4: Activating SSL in Netscape Directory Server 4.12.

5.5.4 Step 4: Activating SSL in Netscape Directory Server 4.12

After you install the certificate, complete the following to activate SSL:

  1. In the navigation tree in Netscape Console, select the server you want to use SSL encryption with.

  2. Click Open > Configuration > Encryption.

  3. Enter the following information:

    Enable SSL: Select this option.

    Cipher Family: Select RSA.

    Token to Use: Select Internal (Software).

    Certificate to Use: Select Server-Cert.

    Client Authentication: Because the driver doesn't support client authentication, select Allow Client Authentication.

  4. Click Save.

  5. Click Tasks, then restart the server for the changes to take effect.

  6. Continue with Step 5: Exporting the Trusted Root from the Directory Tree.

5.5.5 Step 5: Exporting the Trusted Root from the Directory Tree

  1. In iManager, select eDirectory Administration > Modify Object.

  2. Browse to the Certificate Authority (CA) object, then click OK.

  3. Select Certificates from the drop-down list.

  4. Click Export.

  5. Click No at the prompt that displays Do you want to export the private key with the certificate?”

  6. Click Next.

  7. In the Filename field, type in a filename (for example, PublicKeyCert), then select Base64 as the format.

  8. Click Export.

  9. Continue with Step 6: Importing the Trusted Root Certificate.

5.5.6 Step 6: Importing the Trusted Root Certificate

You need to import the trusted root certificate into the LDAP server’s trust database and the client’s certificate store.

Importing into the LDAP Server’s Trust Database

You need to import the trusted root certificate into the LDAP server’s trust database. Because the server certificate was signed by the Identity Vault’s CA, the trust database needs to be configured to trust the Identity Vault CA.

  1. In the Netscape Console, click Tasks > Certificate Setup Wizard > Next.

  2. In Select a Token, accept the default for Internal (Software).

  3. In Is the Server Certificate Already Requested and Ready to Install, select Yes.

  4. Click Next twice.

  5. In Install Certificate For dialog box, select Trusted Certificate Authority.

  6. Click Next.

  7. Select The Certificate Is Located in This File, then type the full path to the .b64 file containing the trusted root certificate.

  8. Click Next.

  9. Verify the information on the screen, then click Add.

  10. Click Done.

  11. Continue with Importing into the Client's Certificate Store.

Importing into the Client's Certificate Store

You need to import the trusted root certificate into a certificate store (also called a keystore) that the driver can use.

  1. Use the KeyTool class found in rt.jar.

    For example, if your public key certificate is saved as PublicKeyCert.b64 on a diskette and you want to import it into a new certificate store file named .keystore in the current directory, type the following at the command line:

    java sun.security.tools.KeyTool -import -alias TrustedRoot -file a:\PublicKeyCert.b64

-keystore .keystore -storepass keystorepass

  2. When you are asked to trust this certificate, select Yes, then click Enter.

  3. Copy the .keystore file to any directory on the same file system that has the Identity Vault files.

  4. In iManager, select Identity Manager > Identity Manager Overview.

  5. Search for drivers.

  6. Click the LDAP Driver object, then click it again in the Identity Manager Driver Overview page.

  7. In the Keystore Path parameter, enter the complete path to the .keystore file.

  8. Continue with Step 7: Adjusting Driver Settings.

5.5.7 Step 7: Adjusting Driver Settings

The following table lists the driver’s settings and its default values in the sample configurations.

Table 5-3 Driver Settings and Default Values

Parameter

Sample Configuration Value

Description

Use SSL for LDAP Connections

no

The value for this parameter should be either Yes or No. It indicates whether or not SSL connections should be used when communicating with the LDAP server. To use SSL, you must also correctly configure the LDAP server.

For more information, refer to Configuring SSL Connections,

SSL Port

636

This parameter is ignored unless Use SSL for LDAP Connections is set to Yes. It indicates which port the LDAP server uses for secure connections.

Keystore Path (for SSL Certs)

[blank]

When Use SSL for LDAP Connections is set to Yes, this parameter value should be the complete path to the keystore file that contains the trusted root certificate of the Certificate Authority (CA) that signed the server certificate.

For more information about creating the keystore file, refer to Importing into the Client's Certificate Store“.