forked from ungleich-public/ungleich-user
Production and the client's test server use ldaps://, so the dev server now offers TLS as well: ldaps on 636 (localhost:3636) and StartTLS on 389, with both ports also published on [::1]. A throwaway CA and server certificate are generated on every start, with the full CA extensions that Python 3.13+ strict verification requires. The CA certificate is copied to dev/ldap/export/ca.crt (gitignored). The server certificate covers localhost, the service names and ::1, but not 127.0.0.1, so tests can show that hostname mismatches are rejected. |
||
|---|---|---|
| .. | ||
| ldap | ||
| env.dev | ||