如何获取ldap / Active目录的ssl证书

Question

am new to LDAP / Active Directory environment.

am trying to connect with LDAP / Active Directory using SSL support.

to connect LDAP/Active Directory, SSL certificate is required to establish the connection.

I have been googling, and most of the result is to "create certificate using Microsoft CA (certificate authority)". Is this is only way to generate certificate for LDAP/Active Directory?

How can i get SSL Certificate for LDAP / Active Directory? Is there any other way to get the SSL Certificate for LDAP/Active Directory?

Answer 1

The OpenSSL tool can be used to:

• generate a new self-signed certificate
• generate a certificate request
• retrieve an existing certificate from an LDAP server using LDAPS (but not StartTLS as of OpenSSL 0.9.8)

OpenSSL is available via the console on Mac OS and most Linux distributions.

You can get OpenSSL for Windows here: OpenSSL Distributions

The Mac Keychain Access application can also be used to generate certificates.

Answer 2

LDAP client code that requires a secure connection should connect to the port upon which the directory server listens for SSL connections, or connect to the port upon which the directory server listens for unsecure connections and promote the connection security using the StartTLS extended operation . The certificate to which you refer is the certificate used by the directory server.