Can anyone "Trust" Directory Server?

Question

I've got a new Lion Server with a new Lion client. I've installed a signed certificate (from StartSSL) which I've validated is verifying correctly through the chain by running:
openssl s_client -connect server.example.net:636
... and getting a final response of:
Verify return code: 0 (ok)
This same certificate is properly encrypting iCal, Address Book, and Web with no special explicit trusting required.
On the client, when I use System Preferences -> Users & Groups to Join the Network Account Server, I get the following prompt:
This server provides SSL certificates. Do you want to trust the certificates from server.example.net?
You can continue without trusting certificates, which could allow unauthorized access to your computer.
WIth the choice of Don't Trust and Trust (default). If I choose Trust, it says "Getting Server Information..." and I get another dialog:
Unable to add server.
Connection failed to the directory server.
(2100)
If I choose Don't Trust, it works fine, but of course, I'm connecting over ldap 389 and not ldaps 636.
Anyone else having this problem with signed certificates? Is anyone having success with signed certificates?

Answer 1

Hi,
If you are going to use SSL for LDAP, you should create a dedicated cert.
You do NOT want to use your standard certificate that u use for all the other services like iCal etc etc.!
So create a dedicated sertificate wich will expire far in the future for example in 10 years or so.
Under the LDAP tab you want to Enable SSL and select your self-signed certificate.
Then go to the Policies tab. I have every single check-box CLEAR and not checked.
You can turn on Encrypt all Packets if you want, but I don’t use that because I have other services that I want to be able to use just standard LDAP and not LDAP over SSL
The reason for that is that some services don’t support LDAPS.
For sure you do not want the Enable authenticated directory binding option selected,
because that disables client-side binding to the directory.
I also keep Kerberos disabled, that gave me a lot of trouble setting it up correctly.
Once you've done all that you can continue to the client setup by manually copy the certificate from the server (You can find the certificate on your server in the /etc/certificates folder)
Hope this helps...
Martyin.