If an attempt is made to create a certificate database called: slapd-<servername>-cert8.db slapd-<servername>-key3.db inside the /opt/fedora-ds/alias directory owned by the ldap user (server configured to run as user ldap:ldap), and from the admin console you click on "manage certificates" for the directory server, you get the message "Could not open file slapd-<servername>-cert8.db". No explanation is given as to why this database could not be opened (file does not exist, insufficient permissions, database corrupt, etc). The path is not included in the error message, and so there is no way to confirm whether the database inside /opt/fedora-ds/alias is the right database, or whether the database should exist elsewhere. As a result, it is currently not possible to enabled SSL on FDS v1.0.4.
I just tried to reproduce this with a clean FDS 1.0.4 install on a RHEL4 system. I ran setup, then started the console, opened the directory server console, clicked on Manage Certificates. I got the dialog asking me for the new ssl pin for the new key/cert db. I entered the pin, and it gave me the Manage Certificates dialog. I could even browse the list of CA certs. The alias directory contains the slapd-localhost-cert8.db and slapd-localhost-key3.db files with the correct ownership and permissions. So at this point, I think we need some more information, because we are missing something here. > As a result, it is currently not possible to enabled SSL on FDS v1.0.4. You can also use the command line tools: http://directory.fedora.redhat.com/wiki/Howto:SSL
Sorry, I wasn't specific enough. The certificate database was created externally using certutil and pk12util, the certificate database was already present when "manage certificates" was clicked the first time. If the database already exists, the directory server refuses to open this database. No specific reasons are given for this in the error message.
If you created the files externally, did you make sure the files were owned by ldap:ldap, were writable e.g. mode 0600, and the alias directory was also owned and writable by ldap:ldap?
The key/cert db layout is much improved in Fedora DS 1.1