Openldap, jndi, ssl openssl keystore problem

Question

I am trying to get a connection between openldap and a java application using jndi. The connection needs to be secure so I want to use ssl. I only want the server to have to have a certificate.
I am having troubles creating the right certificates (self-signed) .
When I create a certificate that works with openldap (see this howto: http://www.openldap.org/pub/ksoper/OpenLDAP_TLS_howto.html#4.2 )
I can only import the cacert.pem into my java keystore, the other to files i can not import. Even when I have converted the servercrt.pem to servercrt.der.
When I use this openldap works and I can connect to it use ldapbrowser (also written in Java)
If I only import the cacert.pem java gives the error:
"AWT-EventQueue-0, handling exception: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: No trusted certificate found"
when trying to connect.
Otherwise if I create a certificate with the java keystore I can't get openldap to work with it.
I used this howto to do that: http://www.churchillobjects.com/c/11201g.html.
So my question is. Does somebody know how to create a certificate that I can use with openldap and also be able to import into the java keystore?

Answer 1

Hello, I had a similar problem: when I tried to connect, a javax.net.ssl.SSLHandshakeException arose. To solve the problem I:
1) Import into my JNDI keystore the certifictate of the CA that had signed my openLDAP certificate (I did not import the server's certificate).
2) Nothing else. I think the problem was in the certificates and not in the java code...
This is what I wrote:
String dirServidor = request.getParameter("dirserver");
String clave = request.getParameter("clave");
String uid = request.getParameter("uid");
System.setProperty("javax.net.debug","all");
System.setProperty("javax.net.ssl.trustStore", YOUR_KEYSTORE?S_PATH);
System.setProperty("javax.net.ssl.trustStorePassword", YOUR_KEYSTORE?S_PASSWORD);
Hashtable props = new Hashtable();
props.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
props.put(Context.PROVIDER_URL, dirServidor);
props.put(Context.SECURITY_PROTOCOL, "ssl");
props.put(Context.SECURITY_AUTHENTICATION, "simple");
props.put(Context.SECURITY_PRINCIPAL, uid);
props.put(Context.SECURITY_CREDENTIALS, clave);
DirContext ctx = null;
try{
     ctx = new InitialDirContext(props);
catch(NamingException e){......}
Bye