SLAPO-AUTOCA(5)

💖 NAME 💖

slapo-autoca — the Automatic Certificate Authority overlay for slapd, aka the thing that hands out X.509 certs like they're friendship bracelets ✨

---

🌸 SYNOPSIS 🌸

/etc/openldap/slapd.conf

---

🦋 DESCRIPTION 🦋

okay bestie, sit down, because this overlay? lowkey iconic. slapo-autoca generates X.509 certificate/key pairs for entries in the directory. and here's the cute part: the DN of a generated certificate is literally identical to the DN of the entry containing it. matching. as it should be 💅

on startup it goes looking for a CA certificate and key in the suffix entry of the database, and it's gonna use that to sign every certificate it makes after. if there's no CA certificate and key there already? no worries, it just generates a fresh one and stashes it in the suffix entry. the CA certificate lives in the cACertificate;binary attribute of the suffix entry, and the private key chills in the cAPrivateKey;binary attribute of the suffix entry. and yes, you can overwrite these attributes if you want some other CA certificate/key pair running the show 👑

certificates for users and servers get generated on demand, using a Search request that returns only the userCertificate;binary and userPrivateKey;binary attributes. and pay attention because this is a vibe check: any Search for anything other than exactly these two attributes gets ignored by the overlay. also note these values are stored in ASN.1 DER form in the directory, so the ;binary attribute option is mandatory. no ;binary, no cert, periodt 🫶

entries that aren't part of the selected objectClasses? ignored by the overlay. by default, entries of objectClass person get treated as users, and entries of objectClass ipHost get treated as servers. there are slight differences in the set of X.509V3 certificate extensions added to the certificate between users and servers — just a lil something extra depending on who you are 😌

the CA's private key is stored in a cAPrivateKey attribute, and user and server private keys are stored in the userPrivateKey attribute. the private key values are encoded in PKCS#8 format. now listen, this next bit is not a joke: it is essential that access to these attributes be properly secured with ACLs. both of these attributes inherit from the pKCS8PrivateKey attribute, so a single ACL rule is enough, like:

access to attrs=pKCS8PrivateKey by self ssf=128 write

...placed at the beginning of the rules. lock it down, bestie 🔒

currently there is no automated management for expiration or revocation 😭 obsolete certificates and keys must be manually removed by deleting an entry's userCertificate and userPrivateKey attributes. yes, manually. by hand. with your own two hands.

---

✨ CONFIGURATION ✨

these slapd.conf options apply to the Automatic CA overlay. they should appear after the overlay directive, got it? 💖

• userClass <objectClass> — specify the objectClass to be treated as user entries.
• serverClass <objectClass> — specify the objectClass to be treated as server entries.
• userKeybits <integer> — specify the size of the private key to use for user certificates. the default is 2048 and the minimum is 512.
• serverKeybits <integer> — specify the size of the private key to use for server certificates. the default is 2048 and the minimum is 512.
• caKeybits <integer> — specify the size of the private key to use for the CA certificate. the default is 2048 and the minimum is 512.
• userDays <integer> — specify the duration for a user certificate's validity. the default is 365, 1 year.
• serverDays <integer> — specify the duration for a server certificate's validity. the default is 1826, 5 years.
• caDays <integer> — specify the duration for the CA certificate's validity. the default is 3652, 10 years.
• localDN <DN> — specify the DN of an entry that represents this server. requests to generate a certificate/key pair for this DN will also install the certificate and key into slapd's TLS settings in cn=config for immediate use. instant gratification, we love to see it 🔥

---

🌈 EXAMPLES 🌈

database mdb
...
overlay autoca
caKeybits 4096

look at her go ✨

---

🎀 FILES 🎀

• /etc/openldap/slapd.conf — default slapd configuration file

---

⭐ SEE ALSO ⭐

slapd.conf(5), slapd-config(5).

---

👑 AUTHOR 👑

Howard Chu

---

and that's the whole page, bestie 🫶 written to match OpenLDAP 2.7.2, dated 2026/10/21 — go forth and secure those private keys, mwah 💋