LDAP Services for NDS supports the Secure Sockets Layer (SSL) protocol to ensure that the connection over which data is transmitted is secure and private.
SSL is a protocol that establishes and maintains secure communication between SSL-enabled servers and clients across the Internet. To ensure message integrity, SSL uses a hashing algorithm. To ensure message privacy, SSL provides for the creation and use of encrypted communications channels. To prevent message forgery, SSL allows the server and, optionally, the client to authenticate each other during the establishment of the secure connection. This release of LDAP does not ask the LDAP client to authenticate itself.
To implement the authentication and encryption processes, SSL uses a cryptographic mechanism called public keys. To establish a secure connection, the server and the client exchange their public keys to establish a session key. The session key will be used to encrypt the data for the life of the connection. A subsequent LDAP connection over SSL will result in the generation of a new session key that is different from the previous one.
Digital certificates, digital IDs, digital passports, or public key certificates are critical for verifying the identity of the contacted server. They are similar to an employee badge that identifies the wearer as an employee of a company.
Each LDAP server requires a digital certificate to implement SSL. Digital certificates are issued by a certification authority (CA). Certificates are stored in a new NDS object, the Key Material object. Use Novell® PKI Services, a snap-in of the NetWare Administrator utility (nwadmn32.exe), to request, manage, and store certificates in NDS. Refer to the Novell PKI Services help system for details on setting up a certificate on a server. You can access Novell PKI Services help by selecting the Help button from any Key Material object page.
In order for the LDAP server to use a specific certificate for LDAP SSL connectivity once it is stored in NDS, you must indicate the Key Material object containing the certificate on the LDAP Server General Page in NetWare Administrator.
NOTE: The Key Material object must be in the same container as the NetWare Server object that will use it.
Although SSL can be configured on both the client and server to ensure the identity of both parties, clients do not require digital certificates to communicate securely. As the LDAP server listens for SSL connections on a special port, all the client needs to do is initiate the connection over that port.
NOTE: When you make changes to your LDAP Services for NDS configuration using NetWare Administrator, many of the changes take effect dynamically without having to restart the LDAP server. However, most SSL configuration changes require a restart. Note the following:
To restart the LDAP Server, type the following at the NetWare server console prompt: UNLOAD NLDAP LOAD NLDAP