Re: Syncrepl with SASL External - SOLVED

[Angela Gavazzi <edv@goetheanum.ch>]

Am Dienstag, 6. MÃrz 2007 19:08 schrieb Pierangelo Masarati:
> Angela Gavazzi wrote:
> > I found out that the problem was double encrypting of the connection:
>
> What does it mean "double encrypting of the connection"?
I mean that if I "force" encryption with demand on the provider and on the 
consumer, then I think the consumer tries to encrypt an encrypted connection. 
When I use allow on the consumer it works and is encryptet, I checked it with 
tcpdump.

>
> > It works now if I set TLSVerifyClient to max. allow on the consumer side.
> > All stronger configurations end in:
> > CA unknown.
>
> This makes much more sense: your TLS configuration is broken.  Are you
> using a self-signed certificate?  Or, is your certificate signed by the
> CA to whom the certificate pointed by TLSCACertificateFile belongs?

The certificate is signed by the CA pointed by TLSCACertficateFile.

Angela
> > Thanks anyway
> >
> > Angela
> >
> >
> > Here the concerning parts of the slapd.conf:
> > *****************************************************************
> > master:
> > ...
> >
> > ...
> > TLSCACertificateFile    /etc/ldap/certs/cacert.pem
> > TLSCACertificatePath    /etc/ldap/certs
> > TLSCertificateFile      /etc/ldap/certs/erde.aag_cert.pem
> > TLSCertificateKeyFile   /etc/ldap/certs/erde.aag_key.pem
> >
> > TLSVerifyClient         demand
> >
> > *****************************************************************
> >  slave:
> >
> >
> > TLSCACertificateFile    /etc/ldap/certs/cacert.pem
> > TLSCACertificatePath    /etc/ldap/certs
> > TLSCertificateFile      /etc/ldap/certs/mond.aag_cert.pem
> > TLSCertificateKeyFile   /etc/ldap/certs/mond.aag_key.pem
> >
> > ##################
> > TLSVerifyClient         demand
> > ##################
> >
> > This has to be set to max allow.
>
> ... to disallow certificate checking.  Fine if that's what you want.
>
> p.
>
>
>
> Ing. Pierangelo Masarati
> OpenLDAP Core Team
>
> SysNet s.n.c.
> Via Dossi, 8 - 27100 Pavia - ITALIA
> http://www.sys-net.it
> ------------------------------------------
> Office:   +39.02.23998309
> Mobile:   +39.333.4963172
> Email:    pierangelo.masarati@sys-net.it
> ------------------------------------------