Solved

How to setup LDAPS on Windows 2008 R2 Server

Posted on 2011-03-03
2
1,210 Views
Last Modified: 2013-11-18
I purchased a SAN cert from Godaddy and am not sure what to do at this point. I have seen one answer that says to retup the request.inf as follows:

[Version]
Signature="$Windows NT$"

[NewRequest]
Subject="CN=DC1.YourDomain.local"  ; enter FQDN here - must be FQDN not another name
PrivateKeyArchive=FALSE
Exportable=FALSE
UserProtected=FALSE
MachineKeySet=TRUE
ProviderName="Microsoft RSA SChannel Cryptographic Provider"
ProviderType=12
UseExistingKeySet=FALSE
RequestType=PKCS10
KeyLength=2048
KeyUsage = 0xF0     ; Digital Signature, Key Encipherment, Nonrepudiation, Data Encipherment ; Alternative 0xA0 for DigSig & Key Encipher only
KeySpec=1
SMIME=TRUE

[EnhancedKeyUsageExtension]
OID=1.3.6.1.5.5.7.3.1 ; Server Authentication
OID=1.3.6.1.5.5.7.3.2 ; Client Authentication
; OID=1.3.6.1.4.1.311.20.2.2 ; Smart Card Logon - include even if you don't use SC right now ; comment out if going to a commercial CA - include if internally issued

[RequestAttributes]
; CertificateTemplate = WebServer ;Change to appropriate template name or OID ;Omit  line if CA is a stand-alone CA or commercial or other non-MS CA
; SAN = "dns=server1.domain.local&dns=server1&dns=ldap.domain.local&dns=server1&ipaddress=192.168.0.1" ; do not include if submitting to commercial CA - purchase a SAN cert and fill in during the appropriate step

Not sure if I need everything or not, but I would love some input. Also, I am using the cert for SSO from an external server, so I am not sure that setting the cert up with the Subject being the local server name (Subject="CN=DC1.YourDomain.local") would work for me. I am guessing that I need to setup an external DNS entry for the LDAP server, and use the external name as my server name (Subject="CN=LDAP.YourExternalDomain.com". Is that correct? Also, if I have 2 LDAP servers on my network, one being the root DC and the other the backup DC, should I be setting this cert up for the backup DC? When I open up communication between the external server and my LDAP server, my firewall will be set to only allow LDAPS communication from their IP to my IP, which will hoepfully lock it down.
0
Comment
Question by:Greg27
2 Comments
 
LVL 11

Accepted Solution

by:
Tasmant earned 500 total points
ID: 35147188
you don't have to open any LDAP/LDAPS port on your external firewall.
if you request a certificate for a web server (using Godaddy).
just insert the FQDN of your webserver (the public name) just after "CN=mywebserver.domain.com".
the common name of the certificate will be "mywebserver.domain.com"
i think you can remove the whole [RequestAttributes] section, unless you want alternate name ot your certificate (SAN)
remove at least the CertificateTemplate line.
remove the OID for smart card logon.
save your file to request.inf
launch the command certreq -new request.inf certreq.req
then i think you can enter the content of the certreq.req file into godaddy to request your certificate.
0
 

Author Closing Comment

by:Greg27
ID: 35265065
Thanks Tasmant.
0

Featured Post

Live: Real-Time Solutions, Start Here

Receive instant 1:1 support from technology experts, using our real-time conversation and whiteboard interface. Your first 5 minutes are always free.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Disabling the Directory Sync Service Account in Office 365 will stop directory synchronization from working.
Last week, our Skyport webinar on “How to secure your Active Directory” (https://www.experts-exchange.com/videos/5810/Webinar-Is-Your-Active-Directory-as-Secure-as-You-Think.html) provided 218 attendees with a step-by-step guide for identifying Acti…
This tutorial will show how to configure a single USB drive with a separate folder for each day of the week. This will allow each of the backups to be kept separate preventing the previous day’s backup from being overwritten. The USB drive must be s…
The viewer will learn the basics of jQuery, including how to invoke it on a web page. Reference your jQuery libraries: (CODE) Include your new external js/jQuery file: (CODE) Write your first lines of code to setup your site for jQuery.: (CODE)

816 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now