5

We are working on a web project where we need to be able to bind to an active directory domain and then pass the user's credentials to the domain to make sure the user has successfully authenticated before we allow them access to one of our web applications. We have HTTPS working fine for the front end to accept the credentials. The problem we are running into is for the connection between our server and the active directory server. The active directory server is maintained by a different section of our IT department and we do not have access to it. This active directory server is using a self-signed certificate and does not have a fully qualified domain name (i.e. people.local).

I have read many places that talk about setting the TLS_REQCERT variable to never; however, I am worried about man-in-the-middle attacks and do not feel comfortable leaving the setting set this way. I have also read some articles that talk about being able to query the active directory server from a Linux command line, view the self-signed certificate, save the self-signed certificate to the local Linux server, and then use this certificate for the trust so that you do not have to set TLS_REQCERT to never. I am not sure how I can go about viewing and saving the self-signed certificate from the Linux command line. I have some CentOS servers that we are running that we need to make this operational on.

Any help that you can provide would be greatly appreciated. Thanks in advance.

John
  • 2,276
  • 7
  • 44
  • 60

2 Answers2

6

I have read many places that talk about setting the TLS_REQCERT variable to never; however, I am worried about man-in-the-middle attacks and do not feel comfortable leaving the setting set this way.

You are to be commended both for thinking about security and for understanding the implications of setting TLS_REQCERT.

I have also read some articles that talk about being able to query the active directory server from a Linux command line, view the self-signed certificate, save the self-signed certificate to the local Linux server...

You can use the openssl tool to do this. Assuming that you can access Active Directory via LDAP-over-SSL on port 636, you could do this:

openssl s_client -connect server.example.com:636 > output < /dev/null

And when the command completes, you'll find that output contains, among other things, the PEM encoded certificate:

00000003)
---
Certificate chain
 0 s:/CN=dc1.example.com
   i:/DC=com/DC=example/DC=dc1/CN=example-DC1-CA
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIGjDCCBXSgAwIBAgIKOxasfwAAAAAADDANBgkqhkiG9w0BAQUFADBaMRMwEQYK
...
-----END CERTIFICATE-----
...

You can remove everything before the BEGIN CERTIFICATE line and everything after the END CERTIFICATE LINE and you should have what you're looking for.

It's also possible that the AD server is not using a self-signed certificate but is instead using a certificate issued by the AD certificate authority. If this is the case, it might be easier just to ask the AD folks for the CA certificate.

larsks
  • 43,623
  • 14
  • 121
  • 180
  • Thank you for the reply. I had been testing with the command openssl s_client -connect server.example.com:636 -showcerts > saved.file < /dev/null and it was causing some problems trying to determine which certificate out of the few that were listed that I needed to use. I have used the command you supplied and it returns a single, but different, certificate that the command that I was using. I will test with the output from your command and see how it goes. – John Dec 14 '10 at 16:00
  • If the server is delivering multiple certificates to you can just put them all into a file and use that as your CA file. There's a good chance that they represent a certificate chain and you'll need them all to validate the server. – larsks Dec 14 '10 at 16:08
0

I recommend to have a dedicated certificate authority server in your organization. You will use this server to issue certificates for all servers in your company. To see the information from a certificate, a key or a certificate request, you can use openssl. See: http://www.openssl.org/support/faq.html and http://www.madboa.com/geek/openssl/

The certificate issued for your LDAP server or, preferably, the root certificate should be imported in the SSL keystore of your application.

Mircea Vutcovici
  • 17,619
  • 4
  • 56
  • 83