I agree with Howard that many answers to TLS/SSL problems with
openldap are already on the email list. I have used these (along with the
help from other users like Peter Savitch) to resolve many issues while
setting up TLS.
At this point I am having problems as follows. I am trying to
perform a ldapsearch with -Z option. The server responds to the client
and the client is able to verify the certificate chain. After that the
TLS handshake fails. The client writes the key/cipher but the server never
receives and responds. I am using openldap 2.1.3 on HP-UX 11.0.
I have also installed openldap 2.1.3 on RH linux. The ldapsearch with
TLS works fine. I have been able to use ldapsearch -Z (from HP) <->
openldap server (Linux). The ldapsearch -Z (from Linux) fails with openldap
server (HP) with the same error.
Thinking it might be a openssl issue I have sent mail to openssl users,
but have not received any response.
Any help is greatly appreciated !
regards,
dinesh
Client:
LS trace: SSL_connect:before/connect initialization
TLS trace: SSL_connect:SSLv2/v3 write client hello A
TLS trace: SSL_connect:SSLv3 read server hello A
TLS certificate verification: depth: 1, err: 0, subject: /C=US/ST=ILLINOIS/L=Lis
leCA/O=Comnet Int/OU=CA/CN=aptrain.comneti.com/Email=dvs@comneti.com,
issuer: /C
=US/ST=ILLINOIS/L=LisleCA/O=Comnet Int/OU=CA/CN=aptrain.comneti.com/Email=dvs@co
mneti.com
TLS certificate verification: depth: 0, err: 0, subject: /C=US/ST=ILLINOIS/O=Com
net Int/OU=CE/CN=aptrain.comneti.com/Email=dvs@comneti.com, issuer:
/C=US/ST=ILL
INOIS/L=LisleCA/O=Comnet Int/OU=CA/CN=aptrain.comneti.com/Email=dvs@comneti.com
TLS trace: SSL_connect:SSLv3 read server certificate A
TLS trace: SSL_connect:SSLv3 read server done A
TLS trace: SSL_connect:SSLv3 write client key exchange A
TLS trace: SSL_connect:SSLv3 write change cipher spec A
TLS trace: SSL_connect:SSLv3 write finished A
TLS trace: SSL_connect:SSLv3 flush data
TLS trace: SSL_connect:error in SSLv3 read finished A
TLS trace: SSL_connect:error in SSLv3 read finished A
TLS: can't connect.
ldap_perror
ldap_start_tls: Connect error (91)
Server:
TLS trace: SSL_accept:before/accept initialization
TLS trace: SSL_accept:SSLv3 read client hello A
TLS trace: SSL_accept:SSLv3 write server hello A
TLS trace: SSL_accept:SSLv3 write certificate A
TLS trace: SSL_accept:SSLv3 write server done A
TLS trace: SSL_accept:SSLv3 flush data
TLS trace: SSL_accept:error in SSLv3 read client certificate A
TLS trace: SSL_accept:error in SSLv3 read client certificate A
TLS: can't accept.
connection_read(10): TLS accept error error=-1 id=1, closing
connection_closing: readying conn=1 sd=10 for close
connection_close: conn=1 sd=10
in slapd.conf:
TLSCertificateFile /opt/openssl/bin/abcnew_cert.pem
TLSCertificateKeyFile /opt/openssl/bin/abckey.pem
TLSCACertificateFile /opt/openssl/demoCA/cacert.pem
TLSCipherSuite HIGH:MEDIUM:+SSLV3
in ldap.conf
ssl start_tls
TLS_CACERT /opt/openssl/demoCA/cacert.pem
Howard Chu wrote:
There are plenty of answers to this question already on this email list.http://www.openldap.org/lists/openldap-software/200205/msg00297.html
http://www.openldap.org/lists/openldap-software/200207/msg00827.html
http://www.openldap.org/lists/openldap-software/200207/msg00580.html
Whatever CA cert you configured in slapd.conf must also be configured on the
client, using the TLS_CACERT option in ldap.conf or your .ldaprc file. If you
didn't create an explicit CA cert and are just using a self-signed server
cert, then that cert must be configured on the client using the TLS_CACERT
option. Read the ldap.conf(5) man page for more info on this option.> -----Original Message-----
> From: owner-openldap-software@OpenLDAP.org
> [mailto:owner-openldap-software@OpenLDAP.org]On Behalf Of
> alexlam@msolutions.com.hk> Hi,
>
> I've got the same problem.
> But it seems related to the "ldapsearch".
> When I use the ldapsearch with version 2.0.23, it can provide TLS
> connection
> to slapd server with 2.1.3.
> Is it a bug with the ldapsearch with version 2.1.3?
>
> Thanks,
> Alex Lam
> ----- Original Message -----
> From: "Hardi Gunawan" <hardigunawan@inbox.lv>
> To: <openldap-software@OpenLDAP.org>> > Hi
> >
> > I've some problem moving from openldap 2.0.23 to 2.1.3.
> >
> > 1) I can't connect using TLS anymore (It works when I downgrade to
> 2.0.23)
> >
> > TLS trace: SSL_accept:failed in SSLv3 read client certificate A
> > TLS: can't accept.
> > TLS: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca
> > s3_pkt.c:985
> >
> > Seems that quite a number of people are having the same problems.-- Howard Chu
Chief Architect, Symas Corp. Director, Highland Sun
http://www.symas.com http://highlandsun.com/hyc
Symas: Premier OpenSource Development and Support