Certificates and AD service

[rslocalhost]

I'm trying to fix a broken AD service (Freenas 11.3). I think the problem is a certificate one. My [Windows Server] DC cert recently expired. I have a new one installed and working on the Windows server. I got a notice from my freenas the cert for the DC had expired (true). I was trying to update it, but it's not working.

I can export the DC's certificate, but not it's private key (private key is marked not exportable). Importing into system -> certificates -> add doesn't seem to work since that seems to require the private key ("Private key is required when importing a certificate"). I can import it as a CA no problem, but I suspect that's not the right place.

In Directory Services -> Active Directory -> Certificate, I can only select the CA certs. If I select the DC's cert and try to enable the service, I get "Certificate matching query does not exist.". If I select the true CA root that signed the DC's cert, then I get "KeyError 'key_length'".

Can anyone shed some light on this? Which one is correct and what do I have to do to fix this?

 

[rslocalhost]

I solved it. Apparently 11.3 U2.1 had a bug or two. Updating to 11.3 U5 fixed it. For those that might find this in the future, the other things I figured out:

The DC's cert goes in (without a private key, public key only) in the CA's. In the Active Directory settings, leave the cert blank for at least 11.3. Do not select any cert.

 

[anodos]

Actually, the SSL/TLS settings for AD are deprecated starting in 12.0. Best strategy is to set the LDAP sasl wrapping to SEAL and SSL to off. We will rely on gssapi.

 

[rslocalhost]

Great to know for when we move to 12. Any other gotchas between 11.3 and 12 regarding AD setup?

 

[anodos]

Great to know for when we move to 12. Any other gotchas between 11.3 and 12 regarding AD setup?

Wait until 12.0-U1. I found an fd / memory leak in the Samba python binding we were using for periodic domain health checks (fixed it in upstream master and in 12.0-stable for U1). It is a migration, and so should be performed during a maintenance window.