Re: [389-users] ssl replication

2011-05-19 Thread solarflow99
The SSL roles are _opposite_ the master/slave roles. The master pushes changes to the slave. So in this instance, the _slave_ is the SSL _server_, and the _master_ is the SSL _client_. > In order to be an SSL server, the slave must have a server cert/key and CA > cert. > In order to be an SSL cl

Re: [389-users] ssl replication

2011-05-19 Thread Rich Megginson
On 05/19/2011 11:18 AM, solarflow99 wrote: The SSL roles are _opposite_ the master/slave roles. The master pushes changes to the slave. So in this instance, the _slave_ is the SSL _server_, and the _master_ is the SSL _client_. In order to be an SSL server, the slave must have a server

Re: [389-users] ssl replication

2011-05-19 Thread solarflow99
> You can use certutil on the master to make a cert for the slave, using > the above command on the master. Then, use pk12util to export the slave > cert/key, then take that pk12 file to the slave and use pk12util to import > it (and use certutil to import the CA cert). > Thanks for this, it w

Re: [389-users] ssl replication

2011-05-19 Thread Rich Megginson
On 05/19/2011 01:26 PM, solarflow99 wrote: You can use certutil on the master to make a cert for the slave, using the above command on the master. Then, use pk12util to export the slave cert/key, then take that pk12 file to the slave and use pk12util to import it (and use certut