[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
Re: ldap-ssl trouble .....
Thanks a lot for you explanation Mister Chu !!
Some light in the darkness....
So there is two way to work with TLS / SSL
1) Normal connection on port 389 ( or an another you can specify when
lounching the server and in the client, that was my mistake :-/ ) and then
turn TLS/SSL with the start TLS request ( -Z option )!
In this way you don't need to run ldaps://
I verified it : only lounch the normal server ( and retired the port number
636 in my ldap.conf sigh' ) #>ldapsearch -x -Z -b o=societe.fr sn=Wayne
works better ( i still have an error but it's with the certificate, i will
work on it a little bit more to find how to correct....)
But with this way the identification / connexion is established in clear....
2) Full secured communication ( connection && data ) with the ldaps://
server on port 636 where SSL take !
This is the way i would prefer because password would be crypted....
This is not standard ?
Can I use ldapsearch to communicate with such a server ? If yes, how ?
Thanks for every help...
Best reguards
----- Original Message -----
From: "Howard Chu" <hyc@highlandsun.com>
To: "Kaufmann Lionel" <wayne-cci@noos.fr>; <openldap-software@OpenLDAP.org>
Sent: Thursday, February 14, 2002 1:52 PM
Subject: RE: ldap-ssl trouble .....
> Port 636 is used for LDAP on SSL. This means that SSL is part of the
> connection from the very beginning. This is the way SSL was used with
> LDAPv2, but is not
> part of any documented standard. The "-Z" option to ldapsearch uses the
> Start TLS request which is defined in LDAPv3. This assumes a connection
that
> was created in the clear, and which then has TLS/SSL activated on it in
> response to this Start TLS request.
>
> By setting up your ldap.conf in this manner you're trying to initiate a
> clear text connection on a port that is expecting SSL, which obviously
> doesn't work. If you're going to use Start TLS you don't need to use port
> 636 at all. If you want to use port 636, you cannot use Start TLS on that
> port because TLS will already be active before any LDAP requests can be
> processed.
>
> -- Howard Chu
> Chief Architect, Symas Corp. Director, Highland Sun
> http://www.symas.com http://highlandsun.com/hyc
> Symas: Premier OpenSource Development and Support
>