[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: Using NSS



On 10/27/2011 08:37 AM, Braden McDaniel wrote:
On Wed, 2011-10-26 at 22:28 -0500, Dan White wrote:
On 26/10/11 22:53 -0400, Braden McDaniel wrote:
I am trying to get OpenLDAP (2.4.24) working with NSS on Fedora 15.  In
cn=config.ldif I have:

        olcTLSCACertificatePath: /etc/pki/nssdb
        olcTLSCertificateFile: endoframe
[snip]

Any ideas of what I might be doing wrong, or where I should be looking
to debug this?
slapd was not started with the proper options to listen on ldaps:/// (port
636).
Thank you.  That got me this far:

         # ldapsearch -H ldaps://rail -b dc=endoframe,dc=net -x -d1
         ldap_url_parse_ext(ldaps://rail)
         ldap_create
         ldap_url_parse_ext(ldaps://rail:636/??base)
         ldap_sasl_bind
         ldap_send_initial_request
         ldap_new_connection 1 1 0
         ldap_int_open_connection
         ldap_connect_to_host: TCP rail:636
         ldap_new_socket: 3
         ldap_prepare_socket: 3
         ldap_connect_to_host: Trying ::1 636
         ldap_pvt_connect: fd: 3 tm: -1 async: 0
         TLS: file endoframe.pem does not end in [.0] - does not appear to be a CA certificate directory file with a properly hashed file name - skipping.
         TLS: error: connect - force handshake failure: errno 0 - moznss error -5938
         TLS: can't connect: TLS error -5938:Encountered end of file.
         ldap_err2string
         ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)

I don't understand why it's looking for a file here.  My impression from
reading<http://www.openldap.org/faq/data/cache/1514.html>  is that the
cert would be pulled from the database.

What is your /etc/openldap/ldap.conf?