Replication reads both the key pair it presents on port 8989 and the certificates it trusts there from the ads-truststore, under the alias configured as ssl-cert-nickname of cn=Crypto Manager,cn=config. The key store used for LDAPS and the one used by the administration connector are never consulted.
setup only ever generates the self-signed ads-certificate in that store. There is no option to import a CA certificate, or a CA-signed key pair, into the ads-truststore while installing. Neither has dsreplication enable.
So a topology secured with an organization's own CA cannot be installed as such: every server has to be fixed by hand afterwards, stopped, with keytool, following the procedure documented in #906 — and the same manual pass has to be repeated for every server that later joins the topology. Miss it on one server and that server cannot connect to the topology at all, since the peers require client authentication.
Suggestion
Let setup provision the store, for example:
--adsCertFile / --adsKeyStore style options importing a CA certificate and a CA-signed key pair into the ads-truststore, setting ssl-cert-nickname accordingly, or- an option pointing the crypto manager at an existing key store instead of the
ads-truststore.
Either way the ads-certificate key pair has to stay in the store: it is the crypto manager instance key, published under cn=instance keys,cn=admin data.
Follow-up of #905 and #906, where only the diagnostics and the manual procedure are addressed. Raised in the review of #906 by @maximthomas.
Replication reads both the key pair it presents on port 8989 and the certificates it trusts there from the
ads-truststore, under the alias configured asssl-cert-nicknameofcn=Crypto Manager,cn=config. The key store used for LDAPS and the one used by the administration connector are never consulted.setuponly ever generates the self-signedads-certificatein that store. There is no option to import a CA certificate, or a CA-signed key pair, into theads-truststorewhile installing. Neither hasdsreplication enable.So a topology secured with an organization's own CA cannot be installed as such: every server has to be fixed by hand afterwards, stopped, with
keytool, following the procedure documented in #906 — and the same manual pass has to be repeated for every server that later joins the topology. Miss it on one server and that server cannot connect to the topology at all, since the peers require client authentication.Suggestion
Let
setupprovision the store, for example:--adsCertFile/--adsKeyStorestyle options importing a CA certificate and a CA-signed key pair into theads-truststore, settingssl-cert-nicknameaccordingly, orads-truststore.Either way the
ads-certificatekey pair has to stay in the store: it is the crypto manager instance key, published undercn=instance keys,cn=admin data.Follow-up of #905 and #906, where only the diagnostics and the manual procedure are addressed. Raised in the review of #906 by @maximthomas.