===== pki setup / ldaps-certificate =====


### create a CA on fed10
vi /etc/pki/tls/openssl.cnf
# set 'dir             = /etc/pki/tls'
touch /etc/pki/tls/index.txt
mkdir /etc/pki/tls/newcerts
echo 01 >/etc/pki/tls/serial
cd /etc/pki/CA
umask 077
openssl genrsa -out private/cakey.pem -des3 2048
openssl req -new -x509 -key private/cakey.pem -days 3650 >cacert.pem

### create ldap-server cert, on ldapserver
mkdir /etc/openldap
cd /etc/openldap
umask 077
openssl genrsa 1024 >slapd.key
openssl req -new -key slapd.key -out slapd.csr
# openssl req -in slapd.csr -noout -text # see contents of request
cp slapd.csr /etc/pki/tls
cd /etc/pki/tls
openssl ca -in slapd.csr -out slapd.crt
cp slapd.crt cacert.pem /etc/openldap

===== openldap setup =====


yum install openldap-server openldap-clients
cd /etc/openldap
chown ldap cacert.pem slapd.crt slapd.key
chmod 400 cacert.pem slapd.crt slapd.key
vi slapd.conf
# make sure core, cosine, nis and inetorgperson schema files are included, and ensure these settings:
TLSCACertificateFile /etc/openldap/cacert.pem 
TLSCertificateFile /etc/openldap/slapd.crt
TLSCertificateKeyFile /etc/openldap/slapd.key

database        bdb
suffix          "dc=fluxcoil,dc=net"
rootdn          "cn=Manager,dc=fluxcoil,dc=net"
rootpw          secret
---------------------------
cp /usr/share/doc/openldap-servers-*/DB_CONFIG.example /var/lib/ldap/DB_CONFIG

chkconfig ldap on
service ldap start

===== openldap filling =====


cat >initial.ldif <