ldapsearch
208
Netscape Directory Server Configuration, Command, and File Reference • December 2001
SSL options
You can use the following command-line options to specify that
ldapsearch
use
LDAPS when communicating with your SSL-enabled Directory Server. You also
use these options if you want to use certificate-based authentication. These options
are valid only when LDAPS has been turned on and configured for your Directory
Server. For information on certificate-based authentication and creating a
certificate database for use with LDAP clients see Chapter 11, “Managing SSL” in
the Netscape Directory Server Administrator’s Guide.
In addition to the standard
ldapsearch
options, to run an
ldapsearch
command
using SSL, you must specify the following:
•
-p
to specify Directory Server’s encrypted port
•
-Z
to specify SSL
•
-P
to specify your certificate database’s file and pathname
•
-N
to specify your certificate name
•
-K
to specify your private key file and pathname
•
-W
to specify your private key database password
-K
Specifies the file and path name of the private key database of the client. This
information is required for certificate-based client authentication.
-m
Specifies the path to the security module database. For example,
/usr/netscape/servers/secmodule.db
. You only need to specify this
option if the security module database is in a different directory from the
certificate database itself.
-N
Specifies the certificate name to use for certificate-based client authentication.
For example,
-N "Server-Cert"
. If this option is specified, then the
-Z
,
-P
,
and
-W
options are required. Also, if this option is specified, then the
-D
and
-w
options must not be specified, or certificate-based authentication will not
occur and the bind operation will use the authentication credentials specified
on
-D
and
-w
. An example command for ldapsearch
-P
Specifies the path and filename of the certificate database of the client. This
option is used only with the
-Z
option. When used on a machine where an
SSL-enabled version of Netscape Communicator is configured, the path
specified on this option can be that of the certificate database for
Communicator. For example,
-P c:\security\cert.db
. The client
security files can also be stored on the Directory Server in the
/usr/netscape/servers/alias
directory. In this case, the
-P
option
would call out a path and filename similar to the following:
-P c:\netscape\servers\alias\client-cert.db.
