Re: (ITS#8917) OpenLDAP

[mhonek@redhat.com]

Thanks for the response Quanah. You're right they're mentioning "some"
LDAP server. And as you indirectly mentioned, with OpenSSL 1.0 the TLS
1.3 is not supported.

However, I believe TLS 1.3 already works with OpenLDAP and OpenSSL.
You might want to give a try to Docker image fedora:rawhide. I was
able to successfully establish TLS 1.3 connection ldapsearch<->slapd.
Tested with:
openldap-2.4.46-8.fc30.x86_64
openssl-1.1.1-0.pre9.2.fc30.x86_64

HTH

Best regards,
Matus
On Fri, Sep 21, 2018 at 8:23 PM Quanah Gibson-Mount <quanah@symas.com> wrot=
e:
>
> --On Friday, September 21, 2018 10:59 AM +0000 mhonek@redhat.com wrote:
>
> > Hi Nancy,
> >
> > I'm not aware of RHEL7 shipping with OpenSSL-1.1, OpenLDAP is linked
> > with openssl-1.0.2 there.
> >
> > Anyway, please report all issues related to TLS in OpenLDAP in Red Hat
> > products to Red Hat Support or Bugzilla, first.
>
> Based on what I read in their report, they have an LDAP server (not
> OpenLDAP) that has TLS 1.3 support, and the ldapsearch binaries on their
> RedHat system won't negotiate TLS 1.3 with that server.  This is not
> surprising, as TLS 1.3 support in OpenSSL is only in the 1.1.1 release
> series and OpenLDAP is not yet updated to link to OpenSSL 1.1.1 (See
> ITS#8914).  I'm currently examining what's necessary for such support.  I
> would not expect any OpenLDAP based ldapsearch binary to be able to
> negotiate TLS 1.3 at this time, and I definitely wouldn't expect any Linu=
x
> distribution OpenLDAP based ldapsearch binary to support it for quite som=
e
> time.  GnuTLS also only recently added TLS 1.3 support in the 3.6.3 relea=
se
> as of July 2018, so this would not work in debian based distributions
> either unless running the very bleeding edge.
>
> Warm regards,
> Quanah
>
>
> --
>
> Quanah Gibson-Mount
> Product Architect
> Symas Corporation
> Packaged, certified, and supported LDAP solutions powered by OpenLDAP:
> <http://www.symas.com>
>


--=20
Mat=C3=BA=C5=A1 Hon=C4=9Bk
Software Engineer
Red Hat Czech