Skip to main content

Renewing Expired Samba DC Certificate

When It's first installed, Samba4 autogenerates self-signed certificate files(ca.pem, cert.pem, and key.pem). These files will be expired 700 days after creation. With the following procedure, the certificate can be renewed.
Suppose that the Domain Name is "example.lcl" and the fully qualified DC hostname is "sambadc.example.lcl".  I should also mention that the Linux Distro I'm using is CentOS 8.

First, create certificate files using the openssl command;

# openssl req -newkey rsa:2048 -keyout EXLCL-Key.pem -nodes -x509 -days 730 -out EXLCL-Cert.pem
    Generating a RSA private key
    writing new private key to 'EXLCL-Key.pem' -----
    You are about to be asked to enter information that
    will be incorporated into your certificate request.
    What you are about to enter is what is called a
    Distinguished Name or a DN. There are quite a few
    fields but you can leave some blank For some fields
    there will be a default value, If you enter
    '.', the field will be left blank. -----

    Country Name (2 letter code) [AU]: TR
    State or Province Name (full name) [Some-State]: Istanbul
    Locality Name (eg, city) []: Istanbul
    Organization Name (eg, company) [Internet Widgits Pty Ltd]: Example Ltd.
    Organizational Unit Name (eg, section) []: Information Systems
    Common Name (e.g. server FQDN or YOUR name) []: sambadc.example.lcl
    Email Address []: admin@example.lcl

Copy certificate files to the location they should be;

    # cp -fp EXTLC-*.pem /usr/local/samba/private/tls/

And the smb.conf file should look like this (pay particular attention to the tls parameters);

# cat /etc/samba/smb.conf
    log level = 1
    netbios name = SAMBADC
    realm = EXAMPLE.LCL
    server role = active directory domain controller
    server services = s3fs, rpc, nbt, wrepl, ldap, cldap, kdc, drepl, winbindd, ntp_signd, kcc, dnsupdate
    workgroup = EXAMPLE
    tls enabled = yes
    tls keyfile = tls/EXLCL-Key.pem
    tls certfile = tls/EXLCL-Cert.pem
    tls cafile =

    path = /usr/local/samba/var/locks/sysvol/example.lcl/scripts
    read only = No

    path = /usr/local/samba/var/locks/sysvol
    read only = No

Restart the Samba. Because I use systemd as the Service Manager;

# systemctl restart samba-ad-dc.service


Popular posts from this blog

Creating Multiple VLANs over Bonding Interfaces with Proper Routing on a Centos Linux Host

In this post, I am going to explain configuring multiple VLANs on a bond interface. First and foremost, I would like to describe the environment and give details of the infrastructure. The server has 4 Ethernet links to a layer 3 switch with names: enp3s0f0, enp3s0f1, enp4s0f0, enp4s0f1 There are two bond interfaces both configured as active-backup bond0, bond1 enp4s0f0 and enp4s0f1 interfaces are bonded as bond0. Bond0 is for making ssh connections and management only so corresponding switch ports are not configured in trunk mode. enp3s0f0 and enp3s0f1 interfaces are bonded as bond1. Bond1 is for data and corresponding switch ports are configured in trunk mode. Bond0 is the default gateway for the server and has IP address Bond1 has three subinterfaces with VLAN 4, 36, 41. IP addresses are,, respectively. Proper communication with other servers on the network we should use routing tables. There are three

Sending Jboss Server Logs to Logstash Using Filebeat with Multiline Support

In addition to sending system logs to logstash, it is possible to add a prospector section to the filebeat.yml for jboss server logs. Sometimes jboss server.log has single events made up from several lines of messages. In such cases Filebeat should be configured for a multiline prospector. Filebeat takes lines do not start with a date pattern (look at pattern in the multiline section "^[[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2}" and negate section is set to true ) and combines them with the previous line that starts with a date pattern. server.log file excerpt where DatePattern: yyyy-MM-dd-HH and ConversionPattern: %d %-5p [%c] %m%n Logstash filter: