7. LDAP

OpenCA provides an LDAP interface for users to download certificates from a central repository. This interface can be utilised by browser address books and specialised LDAP clients.

Before the OpenCA Online components can write certificates and CRLs to the directory you must have an LDAP compliant directory installed and available to the online components (this can be on the same or different machine). One example of an appropriate directory is the OpenLDAP project.

7.1. Configuration of the Directory

A full description of the configuration of your LDAP directory is outside the scope of this document. Important points to note are:
  • Ensure that the following schemas are included (probably in the slapd.conf file):
    • core.schema

    • cosine.schema

    • inetorgperson.schema

    • openca.schema

  • Ensure the directory is started with the appropriate suffix (e.g. o=myorg,c=gb).

  • Ensure the rootdn is specified.

  • Ensure the root password is specified.

7.2. Configuration of the online components

Three configuration files must be configured for the online components to make use of the LDAP directory to store certificates; OPENCADIR/etc/servers/node.conf, OPENCADIR/etc/servers/ldap.conf and OPENCADIR/etc/ldap.xml. If you don't understand the configuration options then please read in the technology guide for more informations. Usually it is enough to set the correct options in ldap.xml or in config.xml.

7.3. Writing Certifciates to the Directory

As long as the option updateLDAPautomatic is set to yes the online components will attempt to upload certificates to the directory after an import. Before this can happen the directory must be initialised and the appropriate structure must be implemented. In this version of OpenCA this initialization is done automatically.