[Date Prev][Date Next] [Chronological] [Thread] [Top]

(ITS#6131) "TLSVerifyClient try" not working with GNU TLS

Full_Name: Kartik Subbarao
Version: 2.4.16
OS: Debian 5.0.1
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (

When TLSVerifyClient is set to "try", OpenLDAP improperly rejects SSL
connections without a client certificate. The problem appears to start with this
section of code in tls.c around line 1564:

    if ( ld->ld_options.ldo_tls_require_cert != LDAP_OPT_X_TLS_NEVER ) {
        err = tls_cert_verify( ssl );
        if ( err && ld->ld_options.ldo_tls_require_cert != LDAP_OPT_X_TLS_ALLOW
            return err;

tls_cert_verify() calls gnutls_certificate_verify_peers2(), which appears to
return error 49 when no client certificate is presented. tls_cert_verify()
doesn't seem to distinguish between this case, and the case of an invalid client
certificate, returning -1 in both cases.