This is a continuation of a previous post, Creating an LDAP Addressbook / Directory where we add SSL encryption to the directory.
In our case, we used a signed Unified Communications Certificate (UCC) (also known as a Subject Alternative Names (SAN) Certificate) from GoDaddy. The following will work for those as well as standard signed certificates. I have not tested with wildcard certificates. If you want to use a self-signed certificate, see the TLS and SSL section of Ubuntu’s OpenLDAP documentation as well as notes at the end of this document.
GoDaddy (or any other signing authority) will, when presented with a CSR (Certificate Signing Request), return a signed certificate as well as their own CA cert. You will already have your private key which you used to generate the CSR. With this information, prepare a file called tls.ldif with (for example):
dn: cn=config add: olcTLSCACertificateFile olcTLSCACertificateFile: /etc/ssl/gd_bundle.crt - add: olcTLSCertificateFile olcTLSCertificateFile: /etc/ssl/webmail.opensolutions.ie.crt - add: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /etc/ssl/webmail.opensolutions.ie.key
And apply the change via:
ldapmodify -Y EXTERNAL -H ldapi:/// -f tls.ldif
On Ubuntu (you own distribution may vary here), you need to add the SSL service by editing /etc/default/slapd and updating the SLAPD_SERVICES line to read:
SLAPD_SERVICES="ldap:/// ldapi:/// ldaps:///"
and then restart the server (/etc/init.d/slapd restart). You should now consider firewalling the standard port (389) to force users to use the encrypted SSL port.
Following our example with Thunderbird, you can now update your LDAP directory configuration by setting the hostname to match the subject name in your UCC / certificate (e.g. abook.opensolutions.ie) and the port to 636.
Notes for Self Signed Certificates
If you are using a self-signed certificate, you need to ensure a couple of things. Let’s assume you created a self-signed certificate for abook.opensolutions.ie. Clients need a special configuration parameter for untrusted / self-signed certificates. Copy your self-signed certificate (e.g. /etc/ssl/webmail.opensolutions.ie.crt above) to the client machine(s) – say /etc/ssl/certs/abook.crt.
Now, on the client machine, add the following line to /etc/ldap/ldap.conf:
TLS_CACERT /etc/ssl/certs/abook.crt
Secondly, the hostname you use to access the LDAP server must also match the certificate subject name – i.e. use abook.opensolutions.ie in this example rather than an IP address / alternative hostname.