0

We are currently using Wildcard certificate with SAN. I can successfully run ldapsearch from my client machine when I added TLS_REQSAN allow in openldap configuration.

Now i'm trying to integrate SSSD with secure LDAP but getting the below error

'Could not start TLS encryption. TLS: hostname does not match CN in peer certificate'

How can I force SSSD to check for Subject Alternate Name(SAN) instead of CN.

Is there a property I could set in SSSD configuration.

Jos
  • 11
  • 1
  • 5

1 Answers1

0

I was able to resolve this error by adding the below property in sssd.conf under domain

krb5_use_enterprise_principal = True
bjoster
  • 4,805
  • 5
  • 25
  • 33
Jos
  • 11
  • 1
  • 5