In order to create the relevant certificates, we need to become our own Certificate Authority (CA). ^[8] This is necessary, so we can sign the server certificate.

We will be using the OpenSSL ^[9] software for this, which is included with every great Linux® distribution.

TLS is used for many types of servers, but the instructions^[10] presented here, are tailored for OpenLDAP.

First we need to generate the CA:

root#  mkdir myCA

Move into that directory:

root#  cd myCA

Now generate the CA:^[11]

root#  /usr/share/ssl/misc/CA.pl -newca
CA certificate filename (or enter to create)
  
Making CA certificate ...
Generating a 1024 bit RSA private key
.......................++++++
.............................++++++
writing new private key to './demoCA/private/cakey.pem'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:AU
State or Province Name (full name) [Some-State]:NSW
Locality Name (eg, city) []:Sydney
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Abmas
Organizational Unit Name (eg, section) []:IT
Common Name (eg, YOUR name) []:ldap.abmas.biz
Email Address []:support@abmas.biz

There are some things to note here.

Now we need to generate the server certificate:

root#  openssl req -new -nodes -keyout newreq.pem -out newreq.pem
Generating a 1024 bit RSA private key
.............++++++
........................................................++++++
writing new private key to 'newreq.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:AU
State or Province Name (full name) [Some-State]:NSW
Locality Name (eg, city) []:Sydney
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Abmas
Organizational Unit Name (eg, section) []:IT
Common Name (eg, YOUR name) []:ldap.abmas.biz
Email Address []:support@abmas.biz
  
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

Again, there are some things to note here.

Now we sign the certificate with the new CA:

root#  /usr/share/ssl/misc/CA.pl -sign
Using configuration from /etc/ssl/openssl.cnf
Enter pass phrase for ./demoCA/private/cakey.pem:
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
	Not Before: Mar  6 18:22:26 2005 EDT
	Not After : Mar  6 18:22:26 2006 EDT
Subject:
	countryName               = AU
	stateOrProvinceName       = NSW
	localityName              = Sydney
	organizationName          = Abmas
	organizationalUnitName    = IT
	commonName                = ldap.abmas.biz
	emailAddress              = support@abmas.biz
X509v3 extensions:
	X509v3 Basic Constraints:
	    CA:FALSE
	Netscape Comment:
	    OpenSSL Generated Certificate
	X509v3 Subject Key Identifier:
	    F7:84:87:25:C4:E8:46:6D:0F:47:27:91:F0:16:E0:86:6A:EE:A3:CE
	X509v3 Authority Key Identifier:
	    keyid:27:44:63:3A:CB:09:DC:B1:FF:32:CC:93:23:A4:F1:B4:D5:F0:7E:CC
	    DirName:/C=AU/ST=NSW/L=Sydney/O=Abmas/OU=IT/
						CN=ldap.abmas.biz/emailAddress=support@abmas.biz
	    serial:00

Certificate is to be certified until Mar  6 18:22:26 2006 EDT (365 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
Signed certificate is in newcert.pem

That completes the server certificate generation.

Now we need to copy the certificates to the right configuration directories, rename them at the same time (for convenience), change the ownership and finally the permissions:

root#  cp demoCA/cacert.pem /etc/openldap/
root#  cp newcert.pem /etc/openldap/servercrt.pem
root#  cp newreq.pem /etc/openldap/serverkey.pem
root#  chown ldap.ldap /etc/openldap/*.pem
root#  chmod 640 /etc/openldap/cacert.pem;
root#  chmod 600 /etc/openldap/serverkey.pem

Now we just need to add these locations to slapd.conf, anywhere before the database declaration as shown here:

TLSCertificateFile /etc/openldap/servercrt.pem
TLSCertificateKeyFile /etc/openldap/serverkey.pem
TLSCACertificateFile /etc/openldap/cacert.pem

Here is the declaration and ldap.conf: ldap.conf

TLS_CACERT /etc/openldap/cacert.pem

That's all there is to it. Now on to the section called “Testing”