>In the matter of security there is the non answered second part of the >question. How to verify server certificate even when using ldaps? I see >no option to specify CA certificate or demanding server certificate >verification.
FWIW, I personally wouldn't say ldaps is "much more secure" than start_tls, but fine, it's not something I care to argue about. But my memory is that at least with OpenLDAP there is a configuration file where you can specify all of these things. Also since OpenLDAP links against a separate TLS library you could put server CA certificates in the "usual place" where the TLS library implementation looks for those things. We use a non-public PKI infrastructure for our LDAP server and we put those server certificates in the appropriate place for the operating system and it Just Works. --Ken ________________________________________________ Kerberos mailing list [email protected] https://mailman.mit.edu/mailman/listinfo/kerberos
