[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: TLS hostname check failure and subjectAltname extension



Michael Ströder wrote:
We're using self-compiled OpenLDAP 2.4.27 under RHEL 6.1 linked against
OpenSSL 1.0.0 libs shipped with RHEL.

(some names are consistently obfuscated herein to keep real names confidential)

Unfortunately we can't get StartTLS to work. It always fails:

# /opt/xxxdir/bin/ldapsearch -x -ZZ ldap://ldap-srv01.rz.domain
ldap_start_tls: Connect error (-11)
additional info: TLS: hostname does not match CN in peer certificate
# /opt/xxxdir/bin/ldapsearch -x -ZZ ldap://ldap.domain
ldap_start_tls: Connect error (-11)
additional info: TLS: hostname does not match CN in peer certificate

But OpenSSL lists the (IMO correct) hostnames in the server's certificate:

---------------------------------- snip ----------------------------------
Subject: CN=ldap.domain,OU=xxx,O=xxx,C=DE
[..]
X509v3 Subject Alternative Name:
email:certificate@xxx.domain,
DNS:ldap.domain,
DNS:ldap-srv01.rz.domain,
DNS:ldap-srv02.rz.domain
---------------------------------- snip ----------------------------------

Is the hostname check confused by the email in the first subjectAltName
sequence value?

I tried to understand the code in function tlso_session_chkhost() in libraries/libldap/tls_o.c (RE24) but got totally confused by the use of vars ntype and gn->type.

Ciao, Michael.