[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
RE: OpenLDAP client test program connecting to LDAP server over SSL failed
Hi Daisy,
-- create an environment variable LDAPCONF
<DAISY>: Question, what value is this environment variable set to? Does OpenSSL or OpenLDAP use this env variable?
> You should set the environment variable LDAPCONF to the location of your ldap configuration file. In my case, I called
the file ldap_ssl_cert_config and I placed it in my home directory. So you would then run:
export LDAPCONF = /home/ven/ldap_ssl_cert_config
Alternately, you could also have a .ldaprc file in your home directory instead of setting this variable.
-- create a file called ldap_ssl_cert_config and placed the following line in it:
TLS_CACERTDIR /etc/pki/tls
<DAISY>: Question, in what directory should I create this file? How is this file “ldap_ssl_cert_config” file used? How does OpenLDAP client know what file to look for, in which directory?
> Sorry, I should have explained this better. The environment variable LDAPCONF must point to the location of this file as shown above.
Create it in any text editor and place the line TLS_CACERTDIR <path to root cert bundle> within this file. The OpenLDAP libraries will either
look for the environment variable LDAPCONF or for a .ldaprc file in your home directory.
And /etc/pki/tls does not exist in my file system. What is this “/etc/pki/tls” anyway?
> TLS_CACERTDIR specifies the location of the SSL certificates root bundle of your OpenSSL installation. In Red Hat Enterprise Linux,
this bundle is located in /etc/pki/tls. What OS are you using? It will depend on that and your OpenSSL installation. Also, see
this for more detailed info: http://linux.die.net/man/5/ldap.conf
cheers,
Ven
From: Mahadevan, Venkatasubramanian [mailto:Venkatasubramanian.Mahadevan@ubc.ca]
Sent: Tuesday, August 30, 2011 6:25 PM
To: Wu, Daisy; openldap-technical@openldap.org
Subject: RE: OpenLDAP client test program connecting to LDAP server over SSL failed
> It failed because of this error: ldap_sasl_bind_s: Can't contact LDAP server (-1) error:14090086:SSL routines: SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
Hi Daisy,
I have noticed that sometimes depending on the version of OpenSSL you are linking the LDAP libraries to, it will throw this
error. So what I did was:
-- create an environment variable LDAPCONF
-- create a file called ldap_ssl_cert_config and placed the following line in it:
TLS_CACERTDIR /etc/pki/tls
-- ran my program
Then it worked and I did not get the error anymore. Hope this helps.
cheers,
Ven