Policy Server Guides › Policy Server Administration Guide › Configuring Policy Server Data Storage Options › Configure LDAP Storage Options › How to Configure SSL Support

How to Configure SSL Support

Configuring an LDAP connection over SSL requires that you configure CA SiteMinder® to use your certificate database files.

Complete the following steps to configure a connection over SSL:

1. Review the SSL connection prerequisites.
2. Install the NSS utility.
3. Create the certificate database files.
4. Add the root Certificate Authority (CA) to the certificate database.
5. Add the server certificate to the certificate database. If the server certificate was signed by a certificate authority, add the root certificate from the respective certificate authority to the certificate database as well.
6. List the certifications in the certificate database.
7. Point the Policy Server to the certificate database.

SSL Prerequisites

Consider the following SSL prerequisites:

• Verify that the directory server is SSL–enabled.

  Note: For more information, see vendor–specific documentation.

• CA SiteMinder® uses a Mozilla LDAP SDK to communicate with LDAP directories and requires that the database files be in a Netscape version file format (cert8.db).

  Important! Do not use Microsoft Internet Explorer to install certificates into your cert8.db database file.

Create the Certificate Database Files

To create the certificate database files, use the Mozilla Network Security Services (NSS) certutil application that is included with the Policy Server

Note: The following procedure details the specific options and arguments to complete the task. For a complete list of the NSS utility options and arguments, refer to the Mozilla documentation on the NSS project page.

Important! Before running a CA SiteMinder® utility or executable on Windows Server 2008, open the command-line window with administrator permissions. Open the command-line window this way, even if your account has administrator privileges.

Follow these steps:

1. From a command prompt, navigate to the installation bin directory.

   Example: C:\Program Files\CA\SiteMinder\bin

   Note: Windows has a native certutil utility. Verify that you are working from the Policy Server bin directory, or you can inadvertently run the Windows certutil utility.

2. Enter the following command:

   certutil -N -d certificate_database_directory
   

   -N

   Creates the cert8.db, key3.db, and secmod.db certificate database files.

   -d certificate_database_directory

   Specifies the directory in which the certutil tool is to create the certificate database files.

   Note: If the file path contains spaces, bracket the path in quotes.

   The utility prompts for a password to encrypt the database key.

3. Enter and confirm the password.

   NSS creates the required certificate database files:

   • cert8.db
   • key3.db
   • secmod.db

Example: Create the Certificate Database Files

certutil -N -d C:\certdatabase

Add the Root Certificate Authority to the Certificate Database

To add the root Certificate Authority (CA), use the Mozilla Network Security Services (NSS) certutil application, which is in the Policy Server.

Note: The following procedure details the specific options and arguments to complete the task. For a complete list of the NSS utility options and arguments, refer to the Mozilla documentation on the NSS project page.

Important! Before running a CA SiteMinder® utility or executable on Windows Server 2008, open the command-line window with administrator permissions. Open the command-line window this way, even if your account has administrator privileges.

Follow these steps:

1. From a command prompt, navigate to the Policy Server installation bin directory.

   Example: C:\Program Files\CA\SiteMinder\bin

   Note: Windows has a native certutil utility. Verify that you are working from the bin directory of the NSS utility, or you can inadvertently run the Windows certutil utility.

2. Run the following command:

   certutil -A -n alias -t trust_arguments -i root_CA_path -d certificate_database_directory
   

   -A

   Adds a certificate to the certificate database.

   -n alias

   Specifies an alias for the certificate.

   Note: If the alias contains spaces, bracket the alias with quotes.

   -t trust_arguments

   Specifies the trust attributes to apply to the certificate. The three available trust categories are expressed in this order: "SSL, email, object signing". In each category position, you can use zero or more of the following attribute arguments.

   p

   Valid peer.

   P

   Trusted peer. This argument implies p.

   c

   Valid CA.

   T

   Trusted CA to issue client certificates. This argument implies c.

   C

   Trusted CA to issue server certificates (SSL only). This argument implies c.

   Important! This argument is required for the SSL trust category.

   u

   Certificate can be used for authentication or signing.

   -i root_CA_path

   Specifies the path to the root CA file. The path includes the certificate name. The valid extensions for a certificate include cert, .cer, and .pem.

   Note: If the file path contains spaces, bracket the path in quotes.

   -d certificate_database_directory

   Specifies the path to the directory that contains the certificate database.

   Note: If the file path contains spaces, bracket the path in quotes.

Example: Adding a Root CA to the Certificate Database

certutil -A -n "My Root CA"  -t "C,," -i C:\certificates\cacert.cer -d C:\certdatabase

Add the Server Certificate to the Certificate Database

To enable communication over SSL, add the server certificate to the certificate. Use the Mozilla Network Security Services (NSS) certutil application, which is available with the Policy Server.

Note: The following procedure details the specific options and arguments to complete the task. For a complete list of the NSS utility options and arguments, refer to the Mozilla documentation on the NSS project page.

Important! Before running a CA SiteMinder® utility or executable on Windows Server 2008, open the command-line window with administrator permissions. Open the command-line window this way, even if your account has administrator privileges.

Follow these steps:

1. From a command prompt, navigate to the Policy Server installation bin directory.

   Example: C:\Program Files\CA\SiteMinder\bin

   Note: Windows has a native certutil utility. Verify that you are working from the bin directory of the NSS utility, or you can inadvertently run the Windows certutil utility.

2. Run the following command:

   certutil -A -n alias -t trust_arguments -i server_certificate_path -d certificate_database_directory
   

   -A

   Adds a certificate to the certificate database.

   -n alias

   Specifies an alias for the certificate.

   Note: If the alias contains spaces, bracket the alias with quotes.

   -t trust_arguments

   Specifies the trust argument. The three available trust categories for each certificate are expressed in this order: "SSL, email, object signing". In each category position, you can use zero or more of the following attribute arguments:

   p

   Valid peer.

   P

   Trusted peer. This argument implies p.

   Important! This argument is required for the SSL trust category.

   -i server_certificate_path

   Specifies the path to the server certificate. The path includes the certificate name. The valid extensions for a certificate include.cert, .cer, and .pem.

   Note: If the file path contains spaces, bracket the path in quotes.

   -d certificate_database_directory

   Specifies the path to the directory that contains the certificate database.

   Note: If the file path contains spaces, bracket the path in quotes.

   NSS adds the server certificate to the certificate database.

Example: Adding a Server Certificate to the Certificate Database

certutil -A -n "My Server Certificate" -t "P,," -i C:\certificates\servercert.cer -d C:\certdatabase

List the Certificates in the Certificate Database

To verify that the certificates are in the certificate database, use the Mozilla Network Security Services (NSS) certutil application. Policy Server includes this tool.

Note: The following procedure details the specific options and arguments to complete the task. For a complete list of the NSS utility options and arguments, refer to the Mozilla documentation on the NSS project page.

Important! Before running a CA SiteMinder® utility or executable on Windows Server 2008, open the command-line window with administrator permissions. Open the command-line window this way, even if your account has administrator privileges.

Follow these steps:

1. From a command prompt, navigate to the Policy Server installation bin directory.

   Example: C:\Program Files\CA\SiteMinder\bin

   Note: Windows has a native certutil utility. Verify that you are working from the bin directory of the NSS utility, or you can inadvertently run the Windows certutil utility.

2. Run the following command:

   certutil -L -d certificate_database_directory
   

   -L

   Lists all of the certificates in the certificate database.

   -d certificate_database_directory

   Specifies the path to the directory that contains the certificate database.

   Note: If the file path contains spaces, bracket the path in quotes.

   This command displays the root CA alias, the server certificate alias, and the trust attributes you specified when adding the certificates to the certificate database.

Example: List the Certificates in the Certificate Database

certutil -L -d C:\certdatabase

Point the Policy Server to the Certificate Database

To communicate with the user directory over SSL, point the Policy Server to the certificate database.

Follow these steps:

1. Start the Policy Server Management Console.

   Important! If you are accessing this graphical user interface on Windows Server 2008, open the shortcut with Administrator permissions. Use Administrator permissions even if you are logged in to the system as an Administrator. For more information, see the release notes for your CA SiteMinder® component.

2. Click the Data tab.
3. Enter the path to the certificate database file in the Netscape Certificate Database File field.

   Example: C:\certdatabase\cert8.db

   Note: The key3.db file must be in the same directory as the cert8.db file.

4. Restart the Policy Server.

   The Policy Server can communicate with the user directory over SSL.