Red Hat DIRECTORY SERVER 8.0, Руководство администратора, Страница: 370 / 552

Chapter 11. Managing SSL
352
with the same ID. Keep a log of issued serial numbers so that no number is ever
duplicated.
8. Export the CA certificate for use with other servers and clients. A client usually requires the CA
certificate to validate the server certificate in an TLS/SSL connection. Use
certutil
to export the
CA certificate in ASCII/PEM format:
certutil -d . -L -n "CA certificate" -a > cacert.asc
The way that the CA certificate is imported is different for every client. For example,
certutil
can import a CA certificate into another Directory Server certificiate database:
cd /etc/dirsrv/slapd-otherserver
certutil -A -d . -n "CA certificate" -t "CT,," -a -i cacert.asc
9. Use
pk12util
to export other server certificates and keys created with
certutil
so that they
can be used on a remote server.
pk12util -d . -o ldap1.p12 -n Server-Cert -w /tmp/pwdfile -k /tmp/pwdfile
The
-w
argument is the password used to encrypt the
.p12
file for transport. The
-k
argument
specifies the password for the key database containing the server certificate being exported to
.p12
.
10. If the Directory Server will run with TLS/SSL enabled, then create a password file (
pin.txt
)
for the server to use so it will not prompt you for a password every time it restarts. Creating the
password file is described in
Section 11.4.3, “Creating a Password File for the Directory Server”
.
The certificates created by
certutil
are automatically available in the
Encryption
tab of the
Console. There is no need to import them because they are already in the certificate database.
11.3.2. certutil Usage
certutil
can be used for a variety of tasks to manage certificates and keys, such as generating
certificate requests and removing certificates from the certificate database. Some of the most common
options are listed in
Table 11.1, “certutil Options”
. For the full list of commands and arguments, run
certutil -H
from the command line.
Options Description
certutil -L -d . -n "
cert_name
" "Pretty prints" the specified certificate; the
cert_name
can specify either a CA certificate or a
client certificate.
certutil -L -d . -n "
cert_name
" > certfile.asc Exports the specified certificate out of the
database to ASCII (PEM) format.
certutil -L -d . -n "
cert_name
" -r > certfile.bin Exports the specified certificate out of the
database to binary format; this can be used
with Directory Server attributes such as
userCertificate;binary
.
Table 11.1. certutil Options