[Date Prev][Date Next] [Chronological] [Thread] [Top]

TLS_CACERT Ignoring Cert Completely in 2.0.27?



Hello,

Does anybody know if TLS_CACERT/TLS_REQCERT doesn't fully
check certs in 2.0.27?  If TLS_CACERT isn't the cert for the
server's
CA, no error occurs and the connection continues, whereas I
was expecting to see it fail, as it does with PADL's
libpam_ldap/nss-ldap (specified with tls_cacert as well). 
The absence of TLS_CACERT allows all connections as well,
only pointing TLS_CACERT to a directory (as an
expecting-failure test) will cause the connection to fail.

Any suggestions?  I am trying to supply a single CA cert to
OpenLDAP so as to use self-signed certs legitimately (which
works fine with PADL's pam/nss libs).

Thanks,

-cg