I posted this on the freenas forums..<\/p>\n
Here’s a short write-up on how I got SSL going with LDAPS against AD for authentication. I used the plugin and am working out of \/ in the jail.
keytool is located at \/usr\/pbi\/subsonic-amd64\/bin
1) Create a cnf file to be used for generating the csr.<\/p>\n
\n[ req ]
default_bits = 2048
distinguished_name = req_distinguished_name
req_extensions = v3_req
x509_extensions = v3_req
[ req_distinguished_name ]
countryName = Country Name (2 letter code)
countryName_default = US
countryName_min = 2
countryName_max = 2
stateOrProvinceName = State or Province Name (full name)
stateOrProvinceName_default = Texas
localityName = Locality Name (eg, city)
localityName_default = San Antonio
0.organizationName = Organization Name (eg, company)
0.organizationName_default = Company
organizationalUnitName = Organizational Unit Name (eg, section)
organizationalUnitName_default = Department
commonName = Common Name (hostname)
commonName_default = subsonic
commonName_max = 64
emailAddress = Email Address
emailAddress_default = email@domain.com<\/a>
emailAddress_max = 64
[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName=@alt_names
[alt_names]
DNS.1 = subsonic
DNS.2 = subsonic.domain.com
IP.1 = 192.168.0.1<\/p>\n<\/blockquote>\n2) Generate the csr and private key<\/p>\n
\nopenssl req -new -sha256 -out subsonic.csr -config subsonic.cnf -newkey rsa:2048 -nodes -keyout subsonic.key<\/p>\n<\/blockquote>\n
3) Submit the CSR to your CA. I used a Windows CA and received the subsonic.cer certificate.
4) Generate a PKCS12 file to be used for the Web SSL Java Keystore. I could not get this working using the sytem keystore, so this one is just for https.<\/p>\n\nopenssl pkcs12 -export -out subsonic.pfx -inkey subsonic.key -in subsonic.cer -certfile CA-Certificate.cer<\/p>\n<\/blockquote>\n
5) Create the Java Keystore to be used for SSL access.<\/p>\n
\n.\/keytool -importkeystore -srckeystore subsonic.pfx -destkeystore subsonic.keystore -srcstoretype PKCS12 -srcalias 1 -destalias subsonic.domain.com<\/p>\n<\/blockquote>\n
6) Add your CA certificate to the system Java Keystore as well. This will be used for LDAPS authentication. The default password is ‘changeit’ You should probably change that as well.<\/p>\n
\n.\/keytool -import -trustcacerts -alias CA-domain.com -file \/CA-Certificate.cer -keystore \/usr\/pbi\/subsonic-amd64\/openjdk7\/jre\/lib\/security\/cacerts<\/p>\n<\/blockquote>\n
7) Enable LDAP Authentcation under Settings\\Advanced<\/p>\n
\nLDAP URL: ldaps:\/\/server.domain.com:636\/dc=domain,dc=com
LDAP search filter: (&(sAMAccountName={0})(&(objectCategory=user)(memberof=cn=subsonic,ou=groups,dc=domain,dc=com)))
LDAP Manager: DOMAIN\\user (non privileged!)<\/p>\n<\/blockquote>\n8) The default user cache is too high. Edit it in \/var\/db\/subsonic\/jetty\/4427\/webapp\/WEB-INF\/classes\/ehcache.xml<\/p>\n
\n<cache name="userCache"
maxElementsInMemory="1000"
eternal="false"
timeToIdleSeconds="3600"
timeToLiveSeconds="3600"
overflowToDisk="false"
diskSpoolBufferSizeMB="1"
statistics="true"\/><\/p>\n<\/blockquote>\n","protected":false},"excerpt":{"rendered":"I posted this on the freenas forums.. Here’s a short write-up on how I got SSL going with LDAPS against AD for authentication. I used the plugin and am working out of \/ in the jail. keytool is located at \/usr\/pbi\/subsonic-amd64\/bin 1) Create a cnf file to be used for generating the csr. [ req […]<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[11],"tags":[],"class_list":["post-190","post","type-post","status-publish","format-standard","hentry","category-linux"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/p1tGEc-34","jetpack_sharing_enabled":true,"jetpack-related-posts":[],"_links":{"self":[{"href":"https:\/\/www.guammie.com\/donovan\/wp-json\/wp\/v2\/posts\/190","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.guammie.com\/donovan\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.guammie.com\/donovan\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.guammie.com\/donovan\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.guammie.com\/donovan\/wp-json\/wp\/v2\/comments?post=190"}],"version-history":[{"count":1,"href":"https:\/\/www.guammie.com\/donovan\/wp-json\/wp\/v2\/posts\/190\/revisions"}],"predecessor-version":[{"id":191,"href":"https:\/\/www.guammie.com\/donovan\/wp-json\/wp\/v2\/posts\/190\/revisions\/191"}],"wp:attachment":[{"href":"https:\/\/www.guammie.com\/donovan\/wp-json\/wp\/v2\/media?parent=190"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.guammie.com\/donovan\/wp-json\/wp\/v2\/categories?post=190"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.guammie.com\/donovan\/wp-json\/wp\/v2\/tags?post=190"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}