Configures security for the LDAP server.
Syntax
[no] ldap ssl {ca-list | cert-verify | mode | ssl-port}
[no] ldap ssl cipher-list {original | fips | cc-ndcpp | fips-and-cc-ndcpp | fips-high-security | cc-ndcpp-high-security | fips-and-cc-ndcpp-high-security | compatible}
[no] ldap ssl min-version {tls1 | tls1.1 | tls1.2}
ldap ssl mode {none | ssl | tls}
Parameters
ssl {ca-list | cert-verify | mode | ssl-port} | Configures LDAP SSL and TLS settings. The following options are available: ca-list <none | default-ca-list>—Configures LDAP to use a supplemental CA list. Use the none option to use the built-in supplemental CA list only. Use default-ca-list to use the default CA certificate list. cert-verify—Enables LDAP SSL/TLS certificate verifications. mode <none | ssl | tls>—Configue if LDAP should use SSl or TLS. The none option uses neither SSL nor TLS to secure LDAP. The ssl option secures LDAP using SSL over the SSL port. The tls option secures LDAP using TLS over the default server port. ssl-port <port>—Configures the SSL port identifier.
|
{tls1 | tls1.1 | tls1.2} | Configures the minimum required version of the SSL protocol for LDAP: tls1—Requires TLSv1 or higher. tls1.1—Requires TLSv1.1 or higher. tls1.2—Requires TLSv1.2 or higher (default).
|
ssl cipher-list {original | fips | cc-ndcpp | fips-and-cc-ndcpp | fips-high-security | cc-ndcpp-high-security | fips-and-cc-ndcpp-high-security | compatible} | Configures the LDAP cipher list for SSL/TLS: original—Original cipher list (maximum compatibility) fips—Compliant with FIPS cc-ndcpp—Compliant with CC-NDPP fips-and-cc-ndcpp—Compliant with both FIPS and CC-NDPP fips-high-security—Compliant with FIPS and excludes low-security ciphers cc-ndcpp-high-security—Compliant with CC-NDPP and excludes low-security ciphers fips-and-cc-ndcpp-high-security—Compliant with both FIPS and CC-NDPP and excludes low-security ciphers compatible—Improved security while maintaining backward compatibility
|
mode {none | ssl | tls} | Configures the method used to secure the LDAP connection. none—Neither SSL nor TLS will be used to secure LDAP. ssl—Configures SSL over the SSL port to secure LDAP. tls—Configures TLS over the default port to secure LDAP.
|
Example
This example specifies that TLS must be used to secure the LDAP connection.
hostname (config) # ldap ssl mode tls
User role
Admin
Command mode
Config