LDAP-UX Client Services B.04.10 with Microsoft Windows Active Directory Server Administrator's Guide

The LDAP-UX Client Services supports Microsoft Windows 2003 or 2003 R2 Active Directory
Server (ADS), Netscape Directory Server (NDS) 6.x and Red Hat Directory Server 7.0/7.1 over
TLS.
Configuration Parameters
LDAP-UX Client Services provides the following parameter in the /etc/opt/ldapux/ldapux_client.conf
file to support TLS.
enable_starttls This integer variable controls whether the TLS feature is enabled or
disabled. The valid values of this parameter are 1 and 0. If you choose
to enable TLS, set this parameter to 1. To disable TLS, set this variable
to 0. By default, TLS is disabled. If the enable_startTLS parameter is
undefined or does not exist, it is processed as the TLS feature is disabled.
If you want to use SSL or TLS, you must perform the following tasks before you run the setup
program:
• Ensure to have the certificate database files, cert8.db or cert7.db and key3.db, on your client
system. See “Configuring the LDAP-UX Client to Use SSL or TLS”for details.
• If you choose to enable TLS, set the enable_starttls parameter to 1 in the
/etc/opt/ldapux/lldapux_client.conf file. To use SSL, set enable_starttls to 0. By default,
TLS is disabled.
Configuring the LDAP-UX Client to Use SSL or TLS
You can choose to enable SSL or TLS with LDAP-UX when you run the setup program. If you
want to use SSL or TLS, you must install Certificate Authority (CA) certificate on your LDAP-UX
Client and configure your LDAP directory server to support SSL or TLS before you run the setup
program.
NOTE: If you already have the certificate database files, cert7.db or cert8.db and key3.db, on your
client for your HP-UX applications, you can simply create a symbolic link /etc/opt/ldapux/cert7.db
that points to cert7.db or /etc/opt/ldapux/cert8.db that points to cert8.db and /etc/opt/ldapux/key3.db
that points to key3.db.
Steps to Download the CA Certificate from Windows 2000 CA Server
Downloading the certificate database from the Netscape Communicator is one way to set up the
certificate batabase into your LDAP-UX Client.
The following steps show you an example on how to download the Certificate Authority (CA)
certificate from Windows 2000 Certificate Authority Server using Netscape Communicator 4.75:
1. Log in to your system as root.
2. Use Netscape Communicator to connect to your Certificate Authority Server. The following
shows an example of using a link to connect to your CA Server:
http://ADS servername/CertSrv
3. Enter "administrator" as the usename and the user's password for Active Directory Server.
4. Select a task, retrieve the CA certificate or certificate revocation list, in the Microsoft Certificate
Services screen. Then, click the Next button.
5. Click the "Install this CA certificate" link in the retrieve the CA certificate or certificate revocation
list window to allow your LDAP-UX client to trust certificates issued from this Certificate
Authority.
6. Click the Next button in the window box which prompts that you are about to go through
the process of accessing a Certificate Authority. This has serious implications on the security
of future encrytions using Netscape.
50 Installing LDAP-UX Client Services