StartTLS problem

[Peter Schober]

* Ortner Nikolaus <N.Ortner at fh-kaernten.at> [2013-03-01 11:40]:
> > 2.) I have tried another solution. I have created certificate, installed into LDAP
> > JKS store, set on LDAP 389 connection handler usage of StartTLS. Then I have
> > added that certificate into java central keystore - C:\Program
> > Files\Java\jdk1.6.0_37\jre\lib\security\cacerts. Then I got another error :
> 
> Don't get confused - it's the LDAP-certificate you have to add to
> the keystore at your IdP (so that the IdP can connect to the LDAP
> and do the authentication/attribute-query things).

Yes. But again I'd only add the issuer (and any intermediaries) of the
LDAP server's certificate to the IdP's trust store, otherwise you'd
have to track and re-add the LDAP server's cert each time it changes
(assuming subject != issuer, otherwise it's moot of course).
-peter