By default the SSL certs are only valid for 2 years.  The interesting part is that no where in the startup scripts for ZLM does it state ..hey your SSL certs are expired.  It just says, everything is started..however when you try to access  your ZLM server, it will error out with unable to connect to port 10636 make sure ndsd is started.

10389 eDirectory LDAP

10636 eDirectory secure LDAP.  if you run netstat -ntlu or p  you will not see port 10636. The screwed up part was that I didn’t realize it was just a simple SSL cert at first, I honestly thought ndsd was having bigger issues.  It wasn’t until much latter in the troubleshooting that I happened to find a hidden log somewhere that I just happened to notice the SSL cert expired due to the date.  Really obscure place..oh well next time I will know.

 

Do the follow to get your secure ldap port back up.

————————————-

# ldapconfig set ‘Require TLS for Simple Binds with Password=no’ -a admin.system

Now we delete the eDirectory certificate authority using ldap tools and recreate it afterwards with the ndsconfig command. Take care that you need to insert the name of the ZLM management zone into the ldapdelete command. You used that during the ZLM installation in step 2 and can get it from the backup of the zlm.conf file:

# ldapdelete -H ldap://localhost:10389 -D cn=admin,o=system -W -Z -x ‘cn=<ZLM management zone name > -TREE CA,cn=Security’
Password: <provide the ZLM Administrator password >

sample:

# ldapdelete -H ldap://localhost:10389 -D cn=admin,o=system -W -Z -x ‘cn=BLX_ZLM002-TREE CA,cn=Security’

Now we use ndsconfig to recreate the certificate authority and that also recreates all the server certificates:

# ndsconfig upgrade

Now we need to migrate the eDirectory configuration file back to the original location:

# mv /etc/opt/novell/eDirectory/conf/nds.conf /etc

and delete the line “/etc/opt/novell/eDirectory/conf/nds.conf”from the file /etc/opt/novell/eDirectory/conf/.edir/instances.0. There must be only one line in containing “/etc/nds.conf”.

# rcndsd restart

Now check if the steps above worked and eDirectory is now listening on the secure ldap port:

# netstat -tanpu | grep 10636

Now we switch back the TLS requirement as the port 10636 is now open:

# ldapconfig set ‘Require TLS for Simple Binds with Password=yes’ -a admin.system

As the certificate authority now has changed, we need to export the new public key of it and add it to the java key store ZLM uses for the secure ldap connection to the edirectory:

First grab the password for the java keystore we need to create from your running ZLM server, not the old config file ! Therefor check the file server.xml of the ZLM tomcat instance for it:

# cat /etc/opt/novell/zenworks/tomcat/base/server.xml | grep keystorePass
keystorePass=”6629e7bf19a845c1a8ee81cb2da50b89”

Then grab the public key of the edirectory certificate authority and copy it to a file eg. called ca.b64:

# openssl s_client -connect localhost:10636 -showcerts -keyform DER

Take care that you copy the second certificate in the list (1 s:/OU=Organizational CA/O=BLX_ZLM002-TREE) starting with “—–BEGIN CERTIFICATE—–” till “—–END CERTIFICATE—–” into the ca.b64 file.

Now create the new java keystore and copy it to the appropriate location:

# /opt/novell/eDirectory/lib64/nds-modules/embox/jre/bin/keytool -import -file ca.b64 -alias

# cp ldap-certs /opt/novell/zenworks/datamodel/share/ldap-certs