Encryption Tab

Use this tab to configure SSL for your directory.

Enable SSL for this server. Select this checkbox to enable SSL communications for the directory. Clear the checkbox to disable SSL.

Use this cipher family. Select the checkbox next to the cipher family or families you want the server to use for SSL communications.

Client Authentication

Check hostname against name in certificate for outbound SSL connections. Select this check box if you want an SSL-enabled Directory Server (with certificate based client authentication turned on) to verify authenticity of a request by matching the hostname against the value assigned to the Common Name (CN) attribute of the subject name in the certificate being presented.

By default, this feature is disabled. If you enable it and if the hostname does not match the CN attribute of the certificate, appropriate error and audit messages are logged. For example, in a replicated environment, messages similar to these are logged in the supplier server's log files if it finds that the peer server's hostname doesn't match the name specified in its certificate:

[DATE] - SSL alert: ldap_sasl_bind("",LDAP_SASL_EXTERNAL) 81 (runtime error -12276 - Unable to communicate securely with peer: requested domain name does not match the server's certificate.)

[DATE] NSMMReplicationPlugin - agmt="cn=to ultra60 client auth" (ultra60:1924): Replication bind with SSL client authentication failed: LDAP error 81 (Can't contact LDAP server)

It is recommended that you turn this attribute on to protect Directory Server's outbound SSL connections against a Man In The Middle (MITN) attack.