LDAP expired SSL certificate

expiredldaprenewssl-certificatetls

The SLL certificate on the LDAP server expired recently, making it impossible to ssh into other Linux machines who relay strictly on LDAP.

Being a self-signed certificate, my understanding is that it cannot be renewed.

Knowing that I need to generate a new certificate, any ideas on how can that certificate be transferred on client machines when no remote authentication is possible because the old SSL is already expired?

Best Answer

You can retrieve the certificate on the client with

openssl s_client -CApath /etc/ssl/certs -verify 10 \
    -connect '<host>:<port>' 2>&1 < /dev/zero | \
    sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' \
    > foo.pem

foo.pem can then be put in the client's trust store.

I'd suggest using a certificate signed by a CA though, even if it is your own CA (easily managed with TinyCA).

The main advantage is that you can import the CA root certificate and don't have to worry about trusting host certificates anymore.

Related Topic