Specifications

Setting Up SSL for LDAP Service
Using Server Admin, you can enable Secure Sockets Layer (SSL) for encrypted
communications between an Open Directory server’s LDAP directory domain and
computers that access it.
SSL uses a digital certicate to provide a certied identity for the server. You can use a
self-signed certicate or a certicate obtained from a certicate authority.
For information about dening, obtaining, and installing certicates on your server,
see Mac OS X Server Security Conguration.
SSL communications for LDAP use port 636. If SSL is disabled for LDAP service,
communications are sent as clear text on port 389.
To set up SSL communications for LDAP service:
1 Open Server Admin and connect to the Open Directory master or an Open Directory
replica server.
2 Click the triangle at the left of the server.
The list of services appears.
3 From the expanded Servers list, select Open Directory.
4 Click Settings, then click LDAP.
5 Select the Enable SSL checkbox.
6 Use the Certicate pop-up menu to choose an SSL certicate that you want LDAP
service to use.
The menu lists all SSL certicates installed on the server. To use a certicate not listed,
choose Manage Certicates from the pop-up menu. For more information about
certicates, see Advanced Server Administration.
7 Click Save.
For more information about exporting users and groups using Workgroup Manager
and on importing records of any type, see User Management.
Creating a Custom SSL Conguration for LDAP
SSL uses a digital certicate to provide a certied identity for the server. You can use
custom digital certicates to congure SSL for your network environment.
The following steps describe the command-line method for creating custom
certicates and provide instructions for implementing them in Server Admin.
19 0 Chapter 9 Maintaining Open Directory Services