Chapter 1. Enabling TLS-encrypted connections to Directory Server

Procedure

1. Create a private key and a certificate signing request (CSR). Skip this step if you want to create them using an external utility.

   • If your host is reachable only by one name, enter:

     # dsctl instance_name tls generate-server-cert-csr -s "CN=server.example.com,O=example_organization"

   • If your host is reachable by multiple names:

     # dsctl instance_name tls generate-server-cert-csr -s "CN=server.example.com,O=example_organization" server.example.com server.example.net

     If you specify the host names as the last parameter, the command adds the Subject Alternative Name (SAN) extension with the DNS:server.example.com, DNS:server.example.net entries to the CSR.

   The string specified in the -s subject parameter must be a valid subject name according to RFC 1485. The CN field in the subject is required, and you must set it to one of the fully-qualified domain names (FQDN) of the server. The command stores the CSR in the /etc/dirsrv/slapd-instance_name/Server-Cert.csr file.

2. Submit the CSR to the certificate authority (CA) to get a certificate issued. For further details, see your CA’s documentation.

3. Import the server certificate issued by the CA to the NSS database:

   • If you created the private key using the dsctl tls generate-server-cert-csr command, enter:

     # dsconf -D "cn=Directory Manager" ldap://server.example.com security certificate add --file /root/instance_name.crt --name "server-cert" --primary-cert

     Remember the name of the certificate you set in the --name _certificate_nickname parameter. You require it in a later step.

   • If you created the private key using an external utility, import the server certificate and the private key:

     # dsctl instance_name tls import-server-key-cert /root/server.crt /root/server.key

     Note that the command requires you to specify the path to the server certificate first and then the path to the private key. This method always sets the nickname of the certificate to Server-Cert.

4. Import the CA certificate to the NSS database:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com security ca-certificate add --file /root/ca.crt --name "Example CA"

5. Set the trust flags of the CA certificate:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com security ca-certificate set-trust-flags "Example CA" --flags "CT,,"

   This configures Directory Server to trust the CA for TLS encryption and certificate-based authentication.

6. Enable TLS and set the LDAPS port:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-securePort=636 nsslapd-security=on

7. Open the LDAPS port in the firewalld service:

   # firewall-cmd --permanent --add-port=636/tcp
   # firewall-cmd --reload

8. Enable the RSA cipher family, set the NSS database security device, and the server certificate name:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com security rsa set --tls-allow-rsa-certificates on --nss-token "internal (software)" --nss-cert-name Server-Cert

   By default, the name of the security device in the NSS database is internal (software)

9. Optional: Disable the plain text LDAP port:

   # dsconf inst security disable_plain_port

10. Restart the instance

    # dsctl instance_name restart

Procedure

1. Navigate to Server Security Certificate Management Certificate Signing Request, and click Create Certificate Signing Request.

2. Set a name for certificate signing request (CSR), common name (CN), and organization (O):

   

   If your host is reachable by multiple names, set the alternative names in the Subject Alternative Names filed.

3. Click Create Certificate Signing Request.

4. View the CSR text and copy it:

   1. Click Node options icon for the CSR you want to view and select View CSR.
   2. Copy the CSR content.
5. Submit the CSR file to the certificate authority (CA) to get a certificate issued. For further details, see your CA’s documentation.
6. When you get the certificate from your CA, navigate to Server Security Certificate Management TLS Certificates, and click Add Server Certificate.

7. Set a unique nickname for the server certificate, upload the issued certificate, and click Add Certificate.

   Remember the certificate nickname, because a later step requires it.

8. Navigate to Server Security Certificate Management Trusted Certificate Authorities, and click Add CA Certificate.
9. Set a unique nickname for the CA certificate, upload the CA certificate file, and click Add Certificate.

10. Optional: If you did not enable TLS encryption during the Directory Server instance installation, enable it:

    1. Navigate to Server Security Settings, and enable the security switch.
    2. On the pop-up window, click Enable Security.
    3. Click Save Configuration on the Security Setting page.

11. Configure the Server Certificate Name on the Security Configuration page:

    1. Navigate to Server Security Security Configuration.
    2. Select the server certificate nickname in the Server Certificate Name drop-down list, and click Save Configuration.
    3. Optional: If you do not see the certificate nickname in the drop-down list, refresh the Security Settings page and perform the previous step again.
12. Optional: If you want to use an LDAPS port other than 636, navigate to the Server Server Settings, set the LDAPS port, and click Save.

13. Open the LDAPS port in the firewalld service:

    # firewall-cmd --permanent --add-port=636/tcp
    # firewall-cmd --reload

14. Optional: Navigate to Server Security Security Configuration, check Require Secure Connections checkbox, and click Save Configuration.

    Directory Server disables the plain text LDAP port.

15. Click Actions in the top right corner, and select Restart Instance.

Procedure

1. Use the following command to change the NSS database password:

   # certutil -d /etc/dirsrv/slapd-instance_name/ -W
   Enter Password or Pin for "NSS Certificate DB":
   Enter a password which will be used to encrypt your keys.
   The password should be at least 8 characters long,
   and should contain at least one non-alphabetic character.
   
   Enter new password:
   Re-enter password:
   Password changed successfully.

2. If you use a password file to start Directory Server automatically without prompting for the NSS database password, replace the old password with the new one in the /etc/dirsrv/slapd-instance_name/pin.txt:

   • If you use the NSS software cryptography module, which is the default:

     Internal (Software) Token:password

   • If you use a Hardware Security Module (HSM):

     name_of_the_token:password

Procedure

1. Create the /etc/dirsrv/slapd-instance_name/pin.txt file with the following content:

   • If you use the NSS software cryptography module, which is the default:

     Internal (Software) Token:password

   • If you use a Hardware Security Module (HSM):

     name_of_the_token:password

2. Set the file permissions:

   # chown dirsrv:root /etc/dirsrv/slapd-instance_name/pin.txt
   # chmod 400 /etc/dirsrv/slapd-instance_name/pin.txt

Procedure

1. If you do not have a local copy of the CA certificate used by Directory Server:

   1. List the certificates in the server’s network security services (NSS) database:

      # certutil -d /etc/dirsrv/slapd-instance_name/ -L
      
      Certificate Nickname                       Trust Attributes
                                                 SSL,S/MIME,JAR/XPI
      
      Example CA                                 C,,
      Server-Cert                                u,u,u

   2. Use the nickname of the CA certificate in the NSS database to export the CA certificate:

      # certutil -d /etc/dirsrv/slapd-instance_name/ -L -n "Example CA" -a > /tmp/ds-ca.crt

2. Copy the CA certificate to the /etc/pki/ca-trust/source/anchors/ directory:

   # cp /tmp/ds-ca.crt /etc/pki/ca-trust/source/anchors/

3. Rebuild the CA trust database:

   # update-ca-trust