Creating SSL keys for OpenLDAP
==============================

First make the Certificate Authority (only need to do this ONCE):

  openssl genrsa -aes128 -out ca.key 2048
  openssl req -new -x509 -days 8000 -key ca.key -out ca.cert -config openssl.cnf -extensions v3_ca

	Fill in the fields as appropriate - not much is critical here
	The passphrase for the CA key is 'example'

Useful info comes from these:

  openssl x509 -in ca.cert -noout -hash
  openssl x509 -in ca.cert -noout -text

Now make a key and certificate for servers accessed through localhost:

  openssl genrsa -out localhost.key 1024
  openssl req -new -key localhost.key -out localhost.csr -config openssl.cnf

	The critical thing here is that the CN field must be 'localhost'

  openssl x509 -req -in localhost.csr -out localhost.cert -CA ca.cert -CAkey ca.key -CAcreateserial -days 7999 -extfile openssl.cnf -extensions v3_req

Check the certificate:

  openssl x509 -in localhost.cert -noout -text

Now make a client key and certificate:

  openssl genrsa -out client.key 1024
  openssl req -new -key client.key -out client.csr -config openssl.cnf

	The critical thing here is that the CN field must be 'A Person'

  openssl x509 -req -in client.csr -out client.cert -CA ca.cert -CAkey ca.key -CAcreateserial -days 7999 -extfile openssl.cnf -extensions client

Check the certificate:

  openssl x509 -in client.cert -noout -text

