
NOTE: If you are using a load-balanced (round robin) solution for your directory server,
obtain the FQDN of one node in the server by entering the following commands.
nslookup <directory-server-FQDN>
A list of IP addresses is returned. Select one IP address and enter:
nslookup <directory-server-IP address>
Enter the FQDN returned for this IP address as the <directory-server-FQDN> in the
openssl command above.
6. Edit ad.pem and remove all lines except for the contents of the certificate, and the Begin
Certificate and End Certificate lines.
Keep all certificates in the file so that you include the entire chain. Make sure there are no
blank lines or white space.
Example ad.pem file after editing:
-----BEGIN CERTIFICATE-----
MIIEDTCCAvWgAwIBAgIJANgTCE
…
IFl1P+c9Gro82S7z
-----END CERTIFICATE-----
7. Join the ca.pem and ad.pem certificates into ldapserver.pem by entering the following
command.
sudo cat ca.pem ad.pem > ldapserver.pem
8. Replace the old ldapserver.pem certificate file with the new file using the following
commands:
sudo mv /ci/data/keystone/ldapserver.pem /ci/data/keystone/ldapserver.pem.old
sudo mv ldapserver.pem /ci/data/keystone/ldapserver.pem
sudo chown trm1:keystone /ci/data/keystone/ldapserver.pem
sudo chmod 640 /ci/data/keystone/ldapserver.pem
9. Edit /etc/keystone/keystone.conf and delete the line tls_req_cert = allow.
sudo sed -i "s/tls_req_cert = allow//g" /etc/keystone/keystone.conf
10. Restart the OpenStack-Keystone service.
sudo service openstack-keystone restart
Using Active Directory 191
Komentarze do niniejszej Instrukcji