I am having a hard time gettin TLS to work with ldap. I have generated my
own slapd.pem file, and been able to recive the cert information using
"openssl s_client -connect localhost:636 -showcerts -tls1". I have
compiled openldap-2.0.25 with --with-tls and with out it at configure
time, also I have tried Redhats openldap-servers-2.0.23-4 rpm. I am
starting slapd the following way. "slapd -u ldap -h 'ldap:/// ldaps:///'
-d 5 -f /etc/openldap/slapd.conf". Does anyone have a clue whats going
on here?
My slapd.conf file is almost as follows.
##################################################################
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#
include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/inetorgperson.schema
include /etc/openldap/schema/nis.schema
pidfile /var/run/slapd.pid
argsfile /var/run/slapd.args
TLSCipherSuite HIGH:MEDIUM:+SSLv2
TLSCertificateFile /usr/share/ssl/certs/slapd.pem
TLSCertificateKeyFile /usr/share/ssl/certs/slapd.pem
database ldbm
suffix "dc=myldap,dc=edu"
rootdn "cn=Manager,dc=myldap,dc=edu"
rootpw secret
directory /var/lib/ldap
index objectClass,uid,uidNumber,gidNumber,memberUid eq
index cn,mail,surname,givenname eq,subinitial
#################################################################
start up debuging information
#################################################################
daemon_init: ldap:/// ldaps:///
daemon_init: listen on ldap:///
daemon_init: listen on ldaps:///
daemon_init: 2 listeners to open...
ldap_url_parse_ext(ldap:///)
daemon: socket() failed errno=97 (Address family not supported by
protocol)
daemon: initialized ldap:///
ldap_url_parse_ext(ldaps:///)
daemon: socket() failed errno=97 (Address family not supported by
protocol)
daemon: initialized ldaps:///
daemon_init: 2 listeners opened
slapd init: initiated server.
slap_sasl_init: initialized!
slapd startup: initiated.
slapd starting
##################################################################
When I try to connect to port 389 with "openssl s_client -connect
localhost:389 -showcerts -tls1".
I get the following output from openssl when trying to connect to 389
##################################################################
CONNECTED(00000003)
13717:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake
failure:s3_pkt.c:490:
##################################################################
and this output from slapd at debug level 5.
##################################################################
connection_get(10)
connection_get(10): got connid=9
connection_read(10): checking for input on id=9
ber_get_next
ber_get_next: tag 0x16 len 3 contents:
ber_get_next on fd 10 failed errno=0 (Success)
connection_read(10): input error=-2 id=9, closing.
connection_closing: readying conn=9 sd=10 for close
connection_close: conn=9 sd=10
##################################################################
I also tried to get a connection with "GQ" using tls on both ports 389
and 636. This is the error I get from slapd at debug level 5 when trying
to connect to port 389.
##################################################################
connection_get(10)
connection_get(10): got connid=2
connection_read(10): checking for input on id=2
ber_get_next
ber_get_next: tag 0x30 len 29 contents:
ber_get_next
ber_get_next on fd 10 failed errno=11 (Resource temporarily unavailable)
do_extended
ber_scanf fmt ({a) ber:
do_extended: oid=1.3.6.1.4.1.1466.20037
send_ldap_extended 0: (0)
send_ldap_response: msgid=1 tag=120 err=0
ber_flush: 14 bytes to sd 10
connection_get(10)
connection_get(10): got connid=2
connection_read(10): checking for input on id=2
TLS trace: SSL_accept:before/accept initialization
TLS trace: SSL_accept:SSLv3 read client hello A
TLS trace: SSL_accept:SSLv3 write server hello A
TLS trace: SSL_accept:SSLv3 write certificate A
TLS trace: SSL_accept:SSLv3 write server done A
TLS trace: SSL_accept:SSLv3 flush data
TLS trace: SSL_accept:error in SSLv3 read client certificate A
TLS trace: SSL_accept:error in SSLv3 read client certificate A
connection_get(10)
connection_get(10): got connid=2
connection_read(10): checking for input on id=2
TLS trace: SSL_accept:SSLv3 read client key exchange A
TLS trace: SSL_accept:SSLv3 read finished A
TLS trace: SSL_accept:SSLv3 write change cipher spec A
TLS trace: SSL_accept:SSLv3 write finished A
TLS trace: SSL_accept:SSLv3 flush data
connection_get(10)
connection_get(10): got connid=2
connection_read(10): checking for input on id=2
ber_get_next
ber_get_next: tag 0x30 len 5 contents:
do_unbind
ber_get_next
ber_get_next on fd 10 failed errno=11 (Resource temporarily unavailable)
connection_closing: readying conn=2 sd=10 for close
connection_resched: reaquiring locks conn=2 sd=10
connection_resched: attempting closing conn=2 sd=10
connection_close: conn=2 sd=10
TLS trace: SSL3 alert write:warning:close notify
slap_sig_shutdown: signal 2
slap_sig_shutdown: signal 2
daemon: shutdown requested and initiated.
slapd shutdown: waiting for 0 threads to terminate
slap_sig_shutdown: signal 2
slapd shutdown: initiated
ldbm backend syncing
ldbm flushing db (dn2id.dbb)
ldbm closing db (dn2id.dbb)
ldbm backend done syncing
====> cache_release_all
slapd shutdown: freeing system resources.
slapd stopped.
################################################################