Netscape NETSCAPE DIRECTORY SERVER 6.1 - ADMINISTRATOR, Administrator'S Manual

Page: 389 / 578

Setting Security Preferences
Chapter 11 Managing SSL 389
10.
If you want Netscape Console to use SSL during communications with
Directory Server, select Use SSL in Netscape Console.
11.
If you configured Directory Server for certificate based client authentication,
you can further configure the server to verify the authenticity of requests by
selecting the “Check hostname against name in certificate for outbound SSL
connections” option. The server does this verification by matching the
hostname against the value assigned to the Common Name (CN) attribute of
the subject name in the certificate being presented for authentication.
By default, this feature is disabled. If it’s enabled and if the hostname does not
match the CN attribute of the certificate, appropriate error and audit messages
are logged. For example, in a replicated environment, messages similar to these
are logged in the supplier server’s log files if it finds that the peer server’s
hostname doesn’t match the name specified in its certificate:
[DATE] - SSL alert: ldap_sasl_bind("",LDAP_SASL_EXTERNAL) 81
(Netscape runtime error -12276 - Unable to communicate securely
with peer: requested domain name does not match the server's
certificate.)
[DATE] NSMMReplicationPlugin - agmt="cn=to ultra60 client auth"
(ultra60:1924): Replication bind with SSL client authentication
failed: LDAP error 81 (Can’t contact LDAP server)
It is recommended that you enable this option to protect Directory Server’s
outbound SSL connections against a Man In The Middle (MITN) attack.
12.
Click Save.
13.
Restart the Directory Server.
See “Starting the Server with SSL Enabled,” on page 40 for more information.
Setting Security Preferences
You can choose the type of ciphers you want to use for SSL communications. A
cipher is the algorithm used in encryption. Some ciphers are more secure or stronger
than others. Generally speaking, the more bits a cipher uses during encryption, the
more difficult it is to decrypt the key. For a more complete discussion of algorithms
and their strength, see Managing Servers with Netscape Console.