https://wiki.ixheim.de/index.php?action=history&feed=atom&title=Configure_and_enable_TLS_for_OpenLDAP 2026-05-15T15:56:51Z Versionsgeschichte dieser Seite in Xinux Wiki MediaWiki 1.35.1 https://wiki.ixheim.de/index.php?title=Configure_and_enable_TLS_for_OpenLDAP&diff=36668&oldid=prev 2022-10-03T12:32:40Z

<p><span dir="auto"><span class="autocomment">If you are ever in the situation to change the paths of your certificates use the following script</span></span></p> <table class="diff diff-contentalign-left diff-editfont-monospace" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="de"> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Nächstältere Version</td> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Version vom 3. Oktober 2022, 12:32 Uhr</td> </tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l69" >Zeile 69:</td> <td colspan="2" class="diff-lineno">Zeile 69:</td></tr> <tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td></tr> <tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>=If you are ever in the situation to change the paths of your certificates use the following script=</div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>=If you are ever in the situation to change the paths of your certificates use the following script=</div></td></tr> <tr><td class='diff-marker'>−</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>;(it's the same script we used above, simply replace add: with replace<del class="diffchange diffchange-inline">:</del>)</div></td><td class='diff-marker'>+</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>;(it's the same script we used above, simply replace add: with replace)</div></td></tr> <tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>&lt;pre&gt;</div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>&lt;pre&gt;</div></td></tr> <tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>File: /root/add_ssl.ldif</div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>File: /root/add_ssl.ldif</div></td></tr> <tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l100" >Zeile 100:</td> <td colspan="2" class="diff-lineno">Zeile 100:</td></tr> <tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>service apache2 restart</div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>service apache2 restart</div></td></tr> <tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>&lt;/pre&gt;</div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>&lt;/pre&gt;</div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"></ins></div></td></tr> <tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>=Quelle=</div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>=Quelle=</div></td></tr> <tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>*https://web.archive.org/web/20161023210915/http://www.dahlem.uk:80/display/deb/Configure+and+enable+TLS+for+OpenLDAP</div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>*https://web.archive.org/web/20161023210915/http://www.dahlem.uk:80/display/deb/Configure+and+enable+TLS+for+OpenLDAP</div></td></tr> </table>

Thomas.will https://wiki.ixheim.de/index.php?title=Configure_and_enable_TLS_for_OpenLDAP&diff=36667&oldid=prev 2022-10-03T12:32:21Z

<p>Die Seite wurde neu angelegt: „=Shell Command= *useradd letsencrypt *chown openldap:letsencrypt /etc/letsencrypt/ -R *usermod -a -G letsencrypt openldap =Make sure the following parameters a…“</p> <p><b>Neue Seite</b></p><div>=Shell Command=<br /> *useradd letsencrypt<br /> *chown openldap:letsencrypt /etc/letsencrypt/ -R<br /> *usermod -a -G letsencrypt openldap<br /> =Make sure the following parameters are set:=<br /> &lt;pre&gt;<br /> File: /etc/default/slapd<br /> SLAPD_SERVICES=&quot;ldap:/// ldapi:/// ldaps:///&quot;<br /> Create a new file with the following contents:<br /> &lt;/pre&gt;<br /> &lt;pre&gt;<br /> File: /root/add_ssl.ldif<br /> dn: cn=config<br /> changetype: modify<br /> add: olcTLSCipherSuite<br /> olcTLSCipherSuite: NORMAL<br /> -<br /> add: olcTLSCRLCheck<br /> olcTLSCRLCheck: none<br /> -<br /> add: olcTLSVerifyClient<br /> olcTLSVerifyClient: never<br /> -<br /> add: olcTLSCACertificateFile<br /> olcTLSCACertificateFile: /etc/letsencrypt/live/&lt;your-domain&gt;/fullchain.pem<br /> -<br /> add: olcTLSCertificateFile<br /> olcTLSCertificateFile: /etc/letsencrypt/live/&lt;your-domain&gt;/cert.pem<br /> -<br /> add: olcTLSCertificateKeyFile<br /> olcTLSCertificateKeyFile: /etc/letsencrypt/live/&lt;your-domain&gt;/privkey.pem<br /> -<br /> add: olcTLSProtocolMin<br /> olcTLSProtocolMin: 3.3<br /> &lt;/pre&gt;<br /> =Apply the changes to your OpenLDAP with the following command=<br /> =Shell Command=<br /> *cd ~<br /> *ldapmodify -Y EXTERNAL -H ldapi:/// -f add_ssl.ldif<br /> =Finally the following output of this command:=<br /> <br /> =Shell Command=<br /> *cat /etc/ldap/slapd.d/cn\=config.ldif<br /> &lt;pre&gt;<br /> # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify.<br /> # CRC32 XXXXXX<br /> dn: cn=config<br /> objectClass: olcGlobal<br /> cn: config<br /> olcArgsFile: /var/run/slapd/slapd.args<br /> olcLogLevel: none<br /> olcPidFile: /var/run/slapd/slapd.pid<br /> olcToolThreads: 1<br /> structuralObjectClass: olcGlobal<br /> entryUUID: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX<br /> creatorsName: cn=config<br /> createTimestamp: XXXXXXXXXXXXXXXXXXXXX<br /> olcTLSCipherSuite: NORMAL<br /> olcTLSCRLCheck: none<br /> olcTLSVerifyClient: never<br /> olcTLSCACertificateFile: /etc/letsencrypt/live/&lt;your-domain&gt;/fullchain.pem<br /> olcTLSCertificateFile: /etc/letsencrypt/live/&lt;your-domain&gt;/cert.pem<br /> olcTLSCertificateKeyFile: /etc/letsencrypt/live/&lt;your-domain&gt;/privkey.pem<br /> olcTLSProtocolMin: 3.3<br /> entryCSN: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX<br /> modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth<br /> modifyTimestamp: XXXXXXXXXXXXXXXX<br /> &lt;/pre&gt;<br /> <br /> =If you are ever in the situation to change the paths of your certificates use the following script=<br /> ;(it's the same script we used above, simply replace add: with replace:)<br /> &lt;pre&gt;<br /> File: /root/add_ssl.ldif<br /> dn: cn=config<br /> changetype: modify<br /> replace: olcTLSCipherSuite<br /> olcTLSCipherSuite: NORMAL<br /> -<br /> replace: olcTLSCRLCheck<br /> olcTLSCRLCheck: none<br /> -<br /> replace: olcTLSVerifyClient<br /> olcTLSVerifyClient: never<br /> -<br /> replace: olcTLSCACertificateFile<br /> olcTLSCACertificateFile: /etc/letsencrypt/live/&lt;your-domain&gt;/fullchain.pem<br /> -<br /> replace: olcTLSCertificateFile<br /> olcTLSCertificateFile: /etc/letsencrypt/live/&lt;your-domain&gt;/cert.pem<br /> -<br /> replace: olcTLSCertificateKeyFile<br /> olcTLSCertificateKeyFile: /etc/letsencrypt/live/&lt;your-domain&gt;/privkey.pem<br /> -<br /> replace: olcTLSProtocolMin<br /> olcTLSProtocolMin: 3.3<br /> Now restart OpenLDAP and Apache2:<br /> <br /> Shell Command<br /> service slapd restart<br /> service apache2 restart<br /> &lt;/pre&gt;<br /> =Quelle=<br /> *https://web.archive.org/web/20161023210915/http://www.dahlem.uk:80/display/deb/Configure+and+enable+TLS+for+OpenLDAP</div>

Thomas.will