Any service I can set up redundantly I, obviously, do. A couple years ago I set up redundant ldap servers. Last year my certificated expired and I generated new ones, not paying any attention to the serial id. Unfortunately, I generated two certificates with duplicate serials. sssd recognized that and failed to authenticate users via ldaps. My company's security requirements are relatively lax so I've just been authenticating over insecure ldap. That just annoys the hell out of me, though, and I've been wanting to fix it - but fix it the right way. Since I can't buy a CA from one of the big boys, I wanted to run my own CA server. [Read more...]