[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
Re: (ITS#9014) OpenLDAP modifies user provided TLS certificate before sending it to client
- To: openldap-its@OpenLDAP.org
- Subject: Re: (ITS#9014) OpenLDAP modifies user provided TLS certificate before sending it to client
- From: siddjain@live.com
- Date: Wed, 24 Apr 2019 16:49:06 +0000
- Auto-submitted: auto-generated (OpenLDAP-ITS)
--_000_MWHPR08MB2400F5334463D5A204E8CF88B53C0MWHPR08MB2400namp_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Wow! Thanks for responding so fast. This could be a bug in docker-openldap =
then. we have repro'ed this in two different environments - mac and ubuntu.=
Do you have a recommendation for docker image for openldap?
________________________________
From: Howard Chu <hyc@symas.com>
Sent: Wednesday, April 24, 2019 9:42 AM
To: Siddharth Jain; openldap-its@OpenLDAP.org
Subject: Re: (ITS#9014) OpenLDAP modifies user provided TLS certificate bef=
ore sending it to client
Siddharth Jain wrote:
> we have documented complete steps to repro the bug here <https://eur04.sa=
felinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fgithub.com%2Fsiddjain%2=
Fopenldap-bug&data=3D02%7C01%7C%7Caca4f78e53324b52690008d6c8d3cc09%7C84=
df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636917209315407238&sdata=3D8Vf=
RtnCNPd%2BFo2Sps%2BLftBG3XcC57ReIFFphK6noyLc%3D&reserved=3D0> with cont=
ainer logs.
I see no error here.
Using your cert/key files:
> ls -l /tmp/jnj
total 12
-rw-r--r-- 1 hyc hyc 1592 Apr 24 17:34 jnj-ca-chain.pem
-rw-r--r-- 1 hyc hyc 241 Apr 24 17:34 jnj-ldap-server-tls.key
-rw-r--r-- 1 hyc hyc 1111 Apr 24 17:34 jnj-ldap-server-tls.pem
###
With this slapd config
vielle:~/OD/hobj/tests> cat testrun/slapd.1.conf
include ./schema/core.schema
include ./schema/cosine.schema
include ./schema/inetorgperson.schema
include ./schema/openldap.schema
include ./schema/nis.schema
include ./testdata/test.schema
pidfile /home/hyc/OD/hobj/tests/testrun/slapd.1.pid
argsfile /home/hyc/OD/hobj/tests/testrun/slapd.1.args
sockbuf_max_incoming 4194303
TLSCAcertificatefile /tmp/jnj/jnj-ca-chain.pem
TLSCertificateFile /tmp/jnj/jnj-ldap-server-tls.pem
TLSCertificateKeyFile /tmp/jnj/jnj-ldap-server-tls.key
database mdb
suffix "dc=3Dexample,dc=3Dcom"
rootdn "cn=3DManager,dc=3Dexample,dc=3Dcom"
rootpw secret
directory /home/hyc/OD/hobj/tests/testrun/db.1.a
index objectClass eq
index cn,sn,uid pres,eq,sub
maxsize 33554432
database monitor
###
And this slapd invocation from the OpenLDAP build tree
vielle:~/OD/hobj/tests> ../servers/slapd/slapd -f testrun/slapd.1.conf -h l=
daps://:9011 -s0 -d7
I get no verification error:
> openssl s_client -connect localhost:9011 -state -nbio -CAfile jnj-ca-chai=
n.pem -showcerts
CONNECTED(00000005)
Turned on non blocking io
SSL_connect:before SSL initialization
SSL_connect:SSLv3/TLS write client hello
SSL_connect:error in SSLv3/TLS write client hello
write R BLOCK
SSL_connect:SSLv3/TLS write client hello
SSL_connect:SSLv3/TLS read server hello
SSL_connect:TLSv1.3 read encrypted extensions
depth=3D2 C =3D US, ST =3D WA, L =3D Bellevue, O =3D Johnson & Johnson, CN =
=3D rca-jnj
verify return:1
depth=3D1 C =3D US, ST =3D WA, L =3D Bellevue, O =3D Johnson & Johnson, OU =
=3D client + OU =3D jnj, CN =3D rca-jnj-admin
verify return:1
depth=3D0 C =3D US, ST =3D WA, L =3D Bellevue, O =3D Johnson & Johnson, OU =
=3D client + OU =3D jnj, CN =3D jnj-ldap-server
verify return:1
SSL_connect:SSLv3/TLS read server certificate
SSL_connect:TLSv1.3 read server certificate verify
SSL_connect:SSLv3/TLS read finished
SSL_connect:SSLv3/TLS write change cipher spec
SSL_connect:SSLv3/TLS write finished
read R BLOCK
---
Certificate chain
0 s:C =3D US, ST =3D WA, L =3D Bellevue, O =3D Johnson & Johnson, OU =3D c=
lient + OU =3D jnj, CN =3D jnj-ldap-server
i:C =3D US, ST =3D WA, L =3D Bellevue, O =3D Johnson & Johnson, OU =3D c=
lient + OU =3D jnj, CN =3D rca-jnj-admin
-----BEGIN CERTIFICATE-----
MIIDBzCCAq2gAwIBAgIUcxrGrCSwJwlQhBEuKztfLgRrtygwCgYIKoZIzj0EAwIw
fjELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAldBMREwDwYDVQQHEwhCZWxsZXZ1ZTEa
MBgGA1UECgwRSm9obnNvbiAmIEpvaG5zb24xGzANBgNVBAsTBmNsaWVudDAKBgNV
BAsTA2puajEWMBQGA1UEAxMNcmNhLWpuai1hZG1pbjAeFw0xOTA0MjIxNzE0MDBa
Fw0yMDA0MjExNzE5MDBaMIGAMQswCQYDVQQGEwJVUzELMAkGA1UECBMCV0ExETAP
BgNVBAcTCEJlbGxldnVlMRowGAYDVQQKDBFKb2huc29uICYgSm9obnNvbjEbMA0G
A1UECxMGY2xpZW50MAoGA1UECxMDam5qMRgwFgYDVQQDEw9qbmotbGRhcC1zZXJ2
ZXIwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARutu4G452HY8vYKJLw9VXmIuz+
X1XNNwyI6q7KzzwNmTwzWyHIVzxjqNTsTRqY0L0lLI1cko2LsIACqnJTed7yo4IB
BDCCAQAwDgYDVR0PAQH/BAQDAgOoMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEF
BQcDAjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBTPS+Zc8+ZDmpVS9XerpVD1gYL7
cjAfBgNVHSMEGDAWgBTbr7PEPX6ZIN6APotjhLkd6hPeqDAaBgNVHREEEzARgg9q
bmotbGRhcC1zZXJ2ZXIwZQYIKgMEBQYHCAEEWXsiYXR0cnMiOnsiaGYuQWZmaWxp
YXRpb24iOiJqbmoiLCJoZi5FbnJvbGxtZW50SUQiOiJqbmotbGRhcC1zZXJ2ZXIi
LCJoZi5UeXBlIjoiY2xpZW50In19MAoGCCqGSM49BAMCA0gAMEUCIQDBbbexORUa
nrBJG8iSkADdOIW/ZOK7kbpLJ4x6GdTO8gIgfzOqW/9ZJKFM3PBls6bEVacoRLX9
AklAHxajASZK+UU=3D
-----END CERTIFICATE-----
1 s:C =3D US, ST =3D WA, L =3D Bellevue, O =3D Johnson & Johnson, OU =3D c=
lient + OU =3D jnj, CN =3D rca-jnj-admin
i:C =3D US, ST =3D WA, L =3D Bellevue, O =3D Johnson & Johnson, CN =3D r=
ca-jnj
-----BEGIN CERTIFICATE-----
MIICQTCCAeegAwIBAgIUBU9O3Wb3BDS8YuWRLYaKClbA9ZcwCgYIKoZIzj0EAwIw
WzELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAldBMREwDwYDVQQHEwhCZWxsZXZ1ZTEa
MBgGA1UECgwRSm9obnNvbiAmIEpvaG5zb24xEDAOBgNVBAMTB3JjYS1qbmowHhcN
MTkwMjAxMjMxOTAwWhcNMjQwMTMxMjMyNDAwWjB+MQswCQYDVQQGEwJVUzELMAkG
A1UECBMCV0ExETAPBgNVBAcTCEJlbGxldnVlMRowGAYDVQQKDBFKb2huc29uICYg
Sm9obnNvbjEbMA0GA1UECxMGY2xpZW50MAoGA1UECxMDam5qMRYwFAYDVQQDEw1y
Y2Etam5qLWFkbWluMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEk4b8f5mWq+jf
iMKQBVI8uU7btAF/LSSdXoOXYPW8JyJ23v5wtwRiQ/g4Al/6aIchvAC4QhJRUnz0
DMKuI7GCp6NmMGQwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAw
HQYDVR0OBBYEFNuvs8Q9fpkg3oA+i2OEuR3qE96oMB8GA1UdIwQYMBaAFBGV3Han
Nf1T5i8fvDh239lt5W9DMAoGCCqGSM49BAMCA0gAMEUCIQD/4+AUOMBdofQEVsH2
2A6UGiJQvuplLEBA9in0cZTcCQIgcV5K+KCs3a5RNYUWdllakGx8c1f6ISrmk4an
gjeXphQ=3D
-----END CERTIFICATE-----
2 s:C =3D US, ST =3D WA, L =3D Bellevue, O =3D Johnson & Johnson, CN =3D r=
ca-jnj
i:C =3D US, ST =3D WA, L =3D Bellevue, O =3D Johnson & Johnson, CN =3D r=
ca-jnj
-----BEGIN CERTIFICATE-----
MIIB/TCCAaOgAwIBAgIUSsxdq02aJCyaIHkIRxRdKvWYG9swCgYIKoZIzj0EAwIw
WzELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAldBMREwDwYDVQQHEwhCZWxsZXZ1ZTEa
MBgGA1UECgwRSm9obnNvbiAmIEpvaG5zb24xEDAOBgNVBAMTB3JjYS1qbmowHhcN
MTkwMjAxMjExNDAwWhcNMzQwMTI4MjExNDAwWjBbMQswCQYDVQQGEwJVUzELMAkG
A1UECBMCV0ExETAPBgNVBAcTCEJlbGxldnVlMRowGAYDVQQKDBFKb2huc29uICYg
Sm9obnNvbjEQMA4GA1UEAxMHcmNhLWpuajBZMBMGByqGSM49AgEGCCqGSM49AwEH
A0IABCF30Cn+O5sD/9n6d3IQQEGiceCTD7gG/5t4dHR4xmvm84HNgRngGKGF4fny
6BXkPSyDguP+L5zozdWDb8dWTQejRTBDMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMB
Af8ECDAGAQH/AgEBMB0GA1UdDgQWBBQRldx2pzX9U+YvH7w4dt/ZbeVvQzAKBggq
hkjOPQQDAgNIADBFAiEAkCQcOP+PmyVIMgr/cUsk04qH8lXYO4DqDuH1WSNvGfEC
IBZQGRehpZ604FgkD0YqmiGRV/OzU99em0g3jkmWJbJY
-----END CERTIFICATE-----
---
Server certificate
subject=3DC =3D US, ST =3D WA, L =3D Bellevue, O =3D Johnson & Johnson, OU =
=3D client + OU =3D jnj, CN =3D jnj-ldap-server
issuer=3DC =3D US, ST =3D WA, L =3D Bellevue, O =3D Johnson & Johnson, OU =
=3D client + OU =3D jnj, CN =3D rca-jnj-admin
---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: ECDSA
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 2254 bytes and written 391 bytes
Verification: OK
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 256 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
SSL_connect:SSL negotiation finished successfully
SSL_connect:SSL negotiation finished successfully
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
Protocol : TLSv1.3
Cipher : TLS_AES_256_GCM_SHA384
Session-ID: 4E6019F281D63D69D1C800DF4D2441CC918FF4A3AFA8A0A6D6D05FFB544=
E91F2
Session-ID-ctx:
Resumption PSK: A00E7F64B5EA00718122A6F34EF0EC9167F437BDB832D9C64834D18=
F367E8AD2AD5F9BCF9649330D321DC19D0AB49882
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 7200 (seconds)
TLS session ticket:
0000 - ea 7e 5b e0 3d 6f 9f 49-78 07 f5 c0 da 78 58 90 .~[.=3Do.Ix...=
.xX.
0010 - 00 78 10 a6 94 fb 36 96-f9 8b 17 53 8b 27 14 b5 .x....6....S.'=
..
0020 - 5d 2d 28 3b db 26 71 44-65 c3 43 d6 8e e8 46 a8 ]-(;.&qDe.C...=
F.
0030 - 05 8a 34 57 c0 42 71 03-4f 70 ad 20 07 74 fc 94 ..4W.Bq.Op. .t=
..
0040 - e8 e4 9d 89 d0 45 db 2c-62 4a 28 b6 31 f9 3f af .....E.,bJ(.1.=
?.
0050 - 46 7c f7 f8 9f b1 0b 7c-ea 70 a1 f0 4c 2f 62 0a F|.....|.p..L/=
b.
0060 - e3 e9 83 47 0e f2 e5 71-a5 0c ba 2a 8d 7d f8 e2 ...G...q...*.}=
..
0070 - 21 84 1a 1a 86 4f 02 0a-4c 9a 17 77 af 9e 64 1f !....O..L..w..=
d.
0080 - 72 c5 e5 45 d1 bb 92 0a-ae fe e9 b1 bc 46 7d 13 r..E.........F=
}.
0090 - aa 2b 9b c1 3d 92 8b 1d-08 6c 11 12 a0 b7 c8 a3 .+..=3D....l..=
....
00a0 - b2 bb 2b d9 bd 70 86 0d-91 45 5c 23 b6 b0 6a 3a ..+..p...E\#..=
j:
00b0 - 61 1d 3a c1 4a 36 48 b4-b3 03 a9 8b 41 94 fd 67 a.:.J6H.....A.=
.g
00c0 - 53 a6 03 a4 ab c6 a0 7e-e9 39 98 a8 c9 01 bc c0 S......~.9....=
..
Start Time: 1556123794
Timeout : 7200 (sec)
Verify return code: 0 (ok)
Extended master secret: no
Max Early Data: 0
---
SSL_connect:SSLv3/TLS read server session ticket
read R BLOCK
SSL_connect:SSL negotiation finished successfully
SSL_connect:SSL negotiation finished successfully
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
Protocol : TLSv1.3
Cipher : TLS_AES_256_GCM_SHA384
Session-ID: A7B81922756F8F5B986C7B38E0F29399F8127F52D042EB7D0DCEDB8D4CD=
577B5
Session-ID-ctx:
Resumption PSK: 5FDD5DF642126A4F04D05EBBECDBB92BBCBAB6A7E05051224D64669=
3BBD0B964C039185F933442D400BBCBC92A832913
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 7200 (seconds)
TLS session ticket:
0000 - ea 7e 5b e0 3d 6f 9f 49-78 07 f5 c0 da 78 58 90 .~[.=3Do.Ix...=
.xX.
0010 - d3 10 28 b9 01 6b 4b 92-1e 3e ae 3b 7f 4e cc 6c ..(..kK..>.;.N=
.l
0020 - 19 d3 0b ac 9c b9 21 4d-ed 78 2c 35 d3 03 ba 11 ......!M.x,5..=
..
0030 - 22 59 1c 0d 91 a5 da 93-a0 0a 54 88 aa 81 be 89 "Y........T...=
..
0040 - e0 2e 74 71 8e c8 fd f7-9d 5c 99 15 42 23 47 cf ..tq.....\..B#=
G.
0050 - 0d 56 97 10 f3 f8 02 fe-69 65 e6 1c fa 7d 96 fe .V......ie...}=
..
0060 - 86 d2 c2 64 2c 6e 96 3d-14 e2 87 47 91 69 ef df ...d,n.=3D...G=
.i..
0070 - 14 d5 75 0d ff da 61 04-26 56 5d 8b d3 4d 2d 2d ..u...a.&V]..M=
--
0080 - 78 fa 65 6d ad ef 15 ba-14 45 f0 ba a6 85 fb 95 x.em.....E....=
..
0090 - dc e5 9b 1c ac e4 66 de-c2 6e 3f e7 1e 47 09 25 ......f..n?..G=
.%
00a0 - 89 b0 c3 c0 4c 93 64 de-23 3e 58 67 ae f3 7e e4 ....L.d.#>Xg..=
~.
00b0 - d5 af 4d 31 40 24 87 da-ec e7 3f 8a 48 b5 9d 23 ..M1@$....?.H.=
.#
00c0 - d4 53 01 fa 18 39 79 0f-9b 9c ea ed 71 63 c5 2f .S...9y.....qc=
./
Start Time: 1556123794
Timeout : 7200 (sec)
Verify return code: 0 (ok)
Extended master secret: no
Max Early Data: 0
---
SSL_connect:SSLv3/TLS read server session ticket
read R BLOCK
SSL3 alert read:warning:close notify
closed
SSL3 alert write:warning:close notify
vielle:/home/software/openldap-bug>
###
There is no OpenLDAP bug here. Your server environment is broken.
--
-- Howard Chu
CTO, Symas Corp. https://eur04.safelinks.protection.outlook.com=
/?url=3Dhttp%3A%2F%2Fwww.symas.com&data=3D02%7C01%7C%7Caca4f78e53324b52=
690008d6c8d3cc09%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C6369172093154=
07238&sdata=3DyzZvZLe34LJJfhMqjtBoGhJqMXnLSPdeBExlpYnMKqY%3D&reserv=
ed=3D0
Director, Highland Sun https://eur04.safelinks.protection.outlook.com=
/?url=3Dhttp%3A%2F%2Fhighlandsun.com%2Fhyc%2F&data=3D02%7C01%7C%7Caca4f=
78e53324b52690008d6c8d3cc09%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C63=
6917209315407238&sdata=3Dc%2B1myt04g7sv1kXBUCwd1bUgQV4HGrjAgYgsPoAXLpA%=
3D&reserved=3D0
Chief Architect, OpenLDAP https://eur04.safelinks.protection.outlook.com=
/?url=3Dhttp%3A%2F%2Fwww.openldap.org%2Fproject%2F&data=3D02%7C01%7C%7C=
aca4f78e53324b52690008d6c8d3cc09%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0=
%7C636917209315407238&sdata=3DbMFyP0JzruNwnxXozQQnUVYg2WrYvQJ1PFDWdgkd6=
zc%3D&reserved=3D0
--_000_MWHPR08MB2400F5334463D5A204E8CF88B53C0MWHPR08MB2400namp_
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-8859-=
1">
<style type=3D"text/css" style=3D"display:none;"> P {margin-top:0;margin-bo=
ttom:0;} </style>
</head>
<body dir=3D"ltr">
<div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;=
color: rgb(0, 0, 0);">
Wow! Thanks for responding so fast. This could be a bug in docker-openldap =
then. we have repro'ed this in two different environments - mac and ubuntu.=
Do you have a recommendation for docker image for openldap? </div>
<div>
<div id=3D"appendonsend"></div>
<div style=3D"font-family:Calibri,Helvetica,sans-serif; font-size:12pt; col=
or:rgb(0,0,0)">
<br>
</div>
<hr tabindex=3D"-1" style=3D"display:inline-block; width:98%">
<div id=3D"divRplyFwdMsg" dir=3D"ltr"><font face=3D"Calibri, sans-serif" co=
lor=3D"#000000" style=3D"font-size:11pt"><b>From:</b> Howard Chu <hyc@sy=
mas.com><br>
<b>Sent:</b> Wednesday, April 24, 2019 9:42 AM<br>
<b>To:</b> Siddharth Jain; openldap-its@OpenLDAP.org<br>
<b>Subject:</b> Re: (ITS#9014) OpenLDAP modifies user provided TLS certific=
ate before sending it to client</font>
<div> </div>
</div>
<div class=3D"BodyFragment"><font size=3D"2"><span style=3D"font-size:11pt"=
>
<div class=3D"PlainText">Siddharth Jain wrote:<br>
> we have documented complete steps to repro the bug here <<a hr=
ef=3D"https://eur04.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fg=
ithub.com%2Fsiddjain%2Fopenldap-bug&amp;data=3D02%7C01%7C%7Caca4f78e533=
24b52690008d6c8d3cc09%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C63691720=
9315407238&amp;sdata=3D8VfRtnCNPd%2BFo2Sps%2BLftBG3XcC57ReIFFphK6noyLc%=
3D&amp;reserved=3D0">https://eur04.safelinks.protection.outlook.com/?ur=
l=3Dhttps%3A%2F%2Fgithub.com%2Fsiddjain%2Fopenldap-bug&amp;data=3D02%7C=
01%7C%7Caca4f78e53324b52690008d6c8d3cc09%7C84df9e7fe9f640afb435aaaaaaaaaaaa=
%7C1%7C0%7C636917209315407238&amp;sdata=3D8VfRtnCNPd%2BFo2Sps%2BLftBG3X=
cC57ReIFFphK6noyLc%3D&amp;reserved=3D0</a>> with
container logs.<br>
<br>
I see no error here.<br>
<br>
Using your cert/key files:<br>
<br>
> ls -l /tmp/jnj<br>
total 12<br>
-rw-r--r-- 1 hyc hyc 1592 Apr 24 17:34 jnj-ca-chain.pem<br>
-rw-r--r-- 1 hyc hyc 241 Apr 24 17:34 jnj-ldap-server-tls.key<br>
-rw-r--r-- 1 hyc hyc 1111 Apr 24 17:34 jnj-ldap-server-tls.pem<br>
<br>
###<br>
<br>
With this slapd config<br>
vielle:~/OD/hobj/tests> cat testrun/slapd.1.conf<br>
<br>
include ./schema/core.schem=
a<br>
include ./schema/cosine.sch=
ema<br>
include ./schema/inetorgper=
son.schema<br>
include ./schema/openldap.s=
chema<br>
include ./schema/nis.schema=
<br>
include ./testdata/test.sch=
ema<br>
<br>
pidfile /home/hyc/OD/hobj/t=
ests/testrun/slapd.1.pid<br>
argsfile /home/hyc/OD/hobj/tests/=
testrun/slapd.1.args<br>
<br>
sockbuf_max_incoming 4194303<br>
<br>
TLSCAcertificatefile /tmp/jnj/jnj-ca-chain.pem<br>
TLSCertificateFile /tmp/jnj/jnj-ldap-server-tls.pem<br>
TLSCertificateKeyFile /tmp/jnj/jnj-ldap-server-tls.key<br>
<br>
<br>
database mdb<br>
suffix "dc=3Dexa=
mple,dc=3Dcom"<br>
rootdn "cn=3DMan=
ager,dc=3Dexample,dc=3Dcom"<br>
rootpw secret<br>
directory /home/hyc/OD/hobj/tests/testr=
un/db.1.a<br>
index objectCla=
ss eq<br>
index cn,sn,uid=
pres,eq,sub<br>
maxsize 33554432<br>
<br>
database monitor<br>
###<br>
<br>
And this slapd invocation from the OpenLDAP build tree<br>
vielle:~/OD/hobj/tests> ../servers/slapd/slapd -f testrun/slapd.1.conf -=
h ldaps://:9011 -s0 -d7<br>
<br>
I get no verification error:<br>
> openssl s_client -connect localhost:9011 -state -nbio -CAfile jnj-ca-c=
hain.pem -showcerts<br>
CONNECTED(00000005)<br>
Turned on non blocking io<br>
SSL_connect:before SSL initialization<br>
SSL_connect:SSLv3/TLS write client hello<br>
SSL_connect:error in SSLv3/TLS write client hello<br>
write R BLOCK<br>
SSL_connect:SSLv3/TLS write client hello<br>
SSL_connect:SSLv3/TLS read server hello<br>
SSL_connect:TLSv1.3 read encrypted extensions<br>
depth=3D2 C =3D US, ST =3D WA, L =3D Bellevue, O =3D Johnson & Johnson,=
CN =3D rca-jnj<br>
verify return:1<br>
depth=3D1 C =3D US, ST =3D WA, L =3D Bellevue, O =3D Johnson & Johnson,=
OU =3D client + OU =3D jnj, CN =3D rca-jnj-admin<br>
verify return:1<br>
depth=3D0 C =3D US, ST =3D WA, L =3D Bellevue, O =3D Johnson & Johnson,=
OU =3D client + OU =3D jnj, CN =3D jnj-ldap-server<br>
verify return:1<br>
SSL_connect:SSLv3/TLS read server certificate<br>
SSL_connect:TLSv1.3 read server certificate verify<br>
SSL_connect:SSLv3/TLS read finished<br>
SSL_connect:SSLv3/TLS write change cipher spec<br>
SSL_connect:SSLv3/TLS write finished<br>
read R BLOCK<br>
---<br>
Certificate chain<br>
0 s:C =3D US, ST =3D WA, L =3D Bellevue, O =3D Johnson & Johnson,=
OU =3D client + OU =3D jnj, CN =3D jnj-ldap-server<br>
i:C =3D US, ST =3D WA, L =3D Bellevue, O =3D Johnson & Joh=
nson, OU =3D client + OU =3D jnj, CN =3D rca-jnj-admin<br>
-----BEGIN CERTIFICATE-----<br>
MIIDBzCCAq2gAwIBAgIUcxrGrCSwJwlQhBEuKztfLgRrtygwCgYIKoZIzj0EAwIw<br>
fjELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAldBMREwDwYDVQQHEwhCZWxsZXZ1ZTEa<br>
MBgGA1UECgwRSm9obnNvbiAmIEpvaG5zb24xGzANBgNVBAsTBmNsaWVudDAKBgNV<br>
BAsTA2puajEWMBQGA1UEAxMNcmNhLWpuai1hZG1pbjAeFw0xOTA0MjIxNzE0MDBa<br>
Fw0yMDA0MjExNzE5MDBaMIGAMQswCQYDVQQGEwJVUzELMAkGA1UECBMCV0ExETAP<br>
BgNVBAcTCEJlbGxldnVlMRowGAYDVQQKDBFKb2huc29uICYgSm9obnNvbjEbMA0G<br>
A1UECxMGY2xpZW50MAoGA1UECxMDam5qMRgwFgYDVQQDEw9qbmotbGRhcC1zZXJ2<br>
ZXIwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARutu4G452HY8vYKJLw9VXmIuz+<br>
X1XNNwyI6q7KzzwNmTwzWyHIVzxjqNTsTRqY0L0lLI1cko2LsIACqnJTed7yo4IB<br>
BDCCAQAwDgYDVR0PAQH/BAQDAgOoMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEF<br>
BQcDAjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBTPS+Zc8+ZDmpVS9XerpVD1gYL7<br=
>
cjAfBgNVHSMEGDAWgBTbr7PEPX6ZIN6APotjhLkd6hPeqDAaBgNVHREEEzARgg9q<br>
bmotbGRhcC1zZXJ2ZXIwZQYIKgMEBQYHCAEEWXsiYXR0cnMiOnsiaGYuQWZmaWxp<br>
YXRpb24iOiJqbmoiLCJoZi5FbnJvbGxtZW50SUQiOiJqbmotbGRhcC1zZXJ2ZXIi<br>
LCJoZi5UeXBlIjoiY2xpZW50In19MAoGCCqGSM49BAMCA0gAMEUCIQDBbbexORUa<br>
nrBJG8iSkADdOIW/ZOK7kbpLJ4x6GdTO8gIgfzOqW/9ZJKFM3PBls6bEVacoRLX9<br>
AklAHxajASZK+UU=3D<br>
-----END CERTIFICATE-----<br>
1 s:C =3D US, ST =3D WA, L =3D Bellevue, O =3D Johnson & Johnson,=
OU =3D client + OU =3D jnj, CN =3D rca-jnj-admin<br>
i:C =3D US, ST =3D WA, L =3D Bellevue, O =3D Johnson & Joh=
nson, CN =3D rca-jnj<br>
-----BEGIN CERTIFICATE-----<br>
MIICQTCCAeegAwIBAgIUBU9O3Wb3BDS8YuWRLYaKClbA9ZcwCgYIKoZIzj0EAwIw<br>
WzELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAldBMREwDwYDVQQHEwhCZWxsZXZ1ZTEa<br>
MBgGA1UECgwRSm9obnNvbiAmIEpvaG5zb24xEDAOBgNVBAMTB3JjYS1qbmowHhcN<br>
MTkwMjAxMjMxOTAwWhcNMjQwMTMxMjMyNDAwWjB+MQswCQYDVQQGEwJVUzELMAkG<br>
A1UECBMCV0ExETAPBgNVBAcTCEJlbGxldnVlMRowGAYDVQQKDBFKb2huc29uICYg<br>
Sm9obnNvbjEbMA0GA1UECxMGY2xpZW50MAoGA1UECxMDam5qMRYwFAYDVQQDEw1y<br>
Y2Etam5qLWFkbWluMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEk4b8f5mWq+jf<br>
iMKQBVI8uU7btAF/LSSdXoOXYPW8JyJ23v5wtwRiQ/g4Al/6aIchvAC4QhJRUnz0<br>
DMKuI7GCp6NmMGQwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAw<br>
HQYDVR0OBBYEFNuvs8Q9fpkg3oA+i2OEuR3qE96oMB8GA1UdIwQYMBaAFBGV3Han<br>
Nf1T5i8fvDh239lt5W9DMAoGCCqGSM49BAMCA0gAMEUCIQD/4+AUOMBdofQEVsH2<br>
2A6UGiJQvuplLEBA9in0cZTcCQIgcV5K+KCs3a5RNYUWdllakGx8c1f6ISrmk4an<br>
gjeXphQ=3D<br>
-----END CERTIFICATE-----<br>
2 s:C =3D US, ST =3D WA, L =3D Bellevue, O =3D Johnson & Johnson,=
CN =3D rca-jnj<br>
i:C =3D US, ST =3D WA, L =3D Bellevue, O =3D Johnson & Joh=
nson, CN =3D rca-jnj<br>
-----BEGIN CERTIFICATE-----<br>
MIIB/TCCAaOgAwIBAgIUSsxdq02aJCyaIHkIRxRdKvWYG9swCgYIKoZIzj0EAwIw<br>
WzELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAldBMREwDwYDVQQHEwhCZWxsZXZ1ZTEa<br>
MBgGA1UECgwRSm9obnNvbiAmIEpvaG5zb24xEDAOBgNVBAMTB3JjYS1qbmowHhcN<br>
MTkwMjAxMjExNDAwWhcNMzQwMTI4MjExNDAwWjBbMQswCQYDVQQGEwJVUzELMAkG<br>
A1UECBMCV0ExETAPBgNVBAcTCEJlbGxldnVlMRowGAYDVQQKDBFKb2huc29uICYg<br>
Sm9obnNvbjEQMA4GA1UEAxMHcmNhLWpuajBZMBMGByqGSM49AgEGCCqGSM49AwEH<br>
A0IABCF30Cn+O5sD/9n6d3IQQEGiceCTD7gG/5t4dHR4xmvm84HNgRngGKGF4fny<br>
6BXkPSyDguP+L5zozdWDb8dWTQejRTBDMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMB<br>
Af8ECDAGAQH/AgEBMB0GA1UdDgQWBBQRldx2pzX9U+YvH7w4dt/ZbeVvQzAKBggq<br>
hkjOPQQDAgNIADBFAiEAkCQcOP+PmyVIMgr/cUsk04qH8lXYO4DqDuH1WSNvGfEC<br>
IBZQGRehpZ604FgkD0YqmiGRV/OzU99em0g3jkmWJbJY<br>
-----END CERTIFICATE-----<br>
---<br>
Server certificate<br>
subject=3DC =3D US, ST =3D WA, L =3D Bellevue, O =3D Johnson & Johnson,=
OU =3D client + OU =3D jnj, CN =3D jnj-ldap-server<br>
<br>
issuer=3DC =3D US, ST =3D WA, L =3D Bellevue, O =3D Johnson & Johnson, =
OU =3D client + OU =3D jnj, CN =3D rca-jnj-admin<br>
<br>
---<br>
No client certificate CA names sent<br>
Peer signing digest: SHA256<br>
Peer signature type: ECDSA<br>
Server Temp Key: X25519, 253 bits<br>
---<br>
SSL handshake has read 2254 bytes and written 391 bytes<br>
Verification: OK<br>
---<br>
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384<br>
Server public key is 256 bit<br>
Secure Renegotiation IS NOT supported<br>
Compression: NONE<br>
Expansion: NONE<br>
No ALPN negotiated<br>
Early data was not sent<br>
Verify return code: 0 (ok)<br>
---<br>
SSL_connect:SSL negotiation finished successfully<br>
SSL_connect:SSL negotiation finished successfully<br>
---<br>
Post-Handshake New Session Ticket arrived:<br>
SSL-Session:<br>
Protocol : TLSv1.3<br>
Cipher : TLS_AES_256_GCM_SHA384<br>
Session-ID: 4E6019F281D63D69D1C800DF4D2441CC918FF4A3AFA8=
A0A6D6D05FFB544E91F2<br>
Session-ID-ctx:<br>
Resumption PSK: A00E7F64B5EA00718122A6F34EF0EC9167F437BD=
B832D9C64834D18F367E8AD2AD5F9BCF9649330D321DC19D0AB49882<br>
PSK identity: None<br>
PSK identity hint: None<br>
SRP username: None<br>
TLS session ticket lifetime hint: 7200 (seconds)<br>
TLS session ticket:<br>
0000 - ea 7e 5b e0 3d 6f 9f 49-78 07 f5 c0 da 78 58 90&n=
bsp; .~[.=3Do.Ix....xX.<br>
0010 - 00 78 10 a6 94 fb 36 96-f9 8b 17 53 8b 27 14 b5&n=
bsp; .x....6....S.'..<br>
0020 - 5d 2d 28 3b db 26 71 44-65 c3 43 d6 8e e8 46 a8&n=
bsp; ]-(;.&qDe.C...F.<br>
0030 - 05 8a 34 57 c0 42 71 03-4f 70 ad 20 07 74 fc 94&n=
bsp; ..4W.Bq.Op. .t..<br>
0040 - e8 e4 9d 89 d0 45 db 2c-62 4a 28 b6 31 f9 3f af&n=
bsp; .....E.,bJ(.1.?.<br>
0050 - 46 7c f7 f8 9f b1 0b 7c-ea 70 a1 f0 4c 2f 62 0a&n=
bsp; F|.....|.p..L/b.<br>
0060 - e3 e9 83 47 0e f2 e5 71-a5 0c ba 2a 8d 7d f8 e2&n=
bsp; ...G...q...*.}..<br>
0070 - 21 84 1a 1a 86 4f 02 0a-4c 9a 17 77 af 9e 64 1f&n=
bsp; !....O..L..w..d.<br>
0080 - 72 c5 e5 45 d1 bb 92 0a-ae fe e9 b1 bc 46 7d 13&n=
bsp; r..E.........F}.<br>
0090 - aa 2b 9b c1 3d 92 8b 1d-08 6c 11 12 a0 b7 c8 a3&n=
bsp; .+..=3D....l......<br>
00a0 - b2 bb 2b d9 bd 70 86 0d-91 45 5c 23 b6 b0 6a 3a&n=
bsp; ..+..p...E\#..j:<br>
00b0 - 61 1d 3a c1 4a 36 48 b4-b3 03 a9 8b 41 94 fd 67&n=
bsp; a.:.J6H.....A..g<br>
00c0 - 53 a6 03 a4 ab c6 a0 7e-e9 39 98 a8 c9 01 bc c0&n=
bsp; S......~.9......<br>
<br>
Start Time: 1556123794<br>
Timeout : 7200 (sec)<br>
Verify return code: 0 (ok)<br>
Extended master secret: no<br>
Max Early Data: 0<br>
---<br>
SSL_connect:SSLv3/TLS read server session ticket<br>
read R BLOCK<br>
SSL_connect:SSL negotiation finished successfully<br>
SSL_connect:SSL negotiation finished successfully<br>
---<br>
Post-Handshake New Session Ticket arrived:<br>
SSL-Session:<br>
Protocol : TLSv1.3<br>
Cipher : TLS_AES_256_GCM_SHA384<br>
Session-ID: A7B81922756F8F5B986C7B38E0F29399F8127F52D042=
EB7D0DCEDB8D4CD577B5<br>
Session-ID-ctx:<br>
Resumption PSK: 5FDD5DF642126A4F04D05EBBECDBB92BBCBAB6A7=
E05051224D646693BBD0B964C039185F933442D400BBCBC92A832913<br>
PSK identity: None<br>
PSK identity hint: None<br>
SRP username: None<br>
TLS session ticket lifetime hint: 7200 (seconds)<br>
TLS session ticket:<br>
0000 - ea 7e 5b e0 3d 6f 9f 49-78 07 f5 c0 da 78 58 90&n=
bsp; .~[.=3Do.Ix....xX.<br>
0010 - d3 10 28 b9 01 6b 4b 92-1e 3e ae 3b 7f 4e cc 6c&n=
bsp; ..(..kK..>.;.N.l<br>
0020 - 19 d3 0b ac 9c b9 21 4d-ed 78 2c 35 d3 03 ba 11&n=
bsp; ......!M.x,5....<br>
0030 - 22 59 1c 0d 91 a5 da 93-a0 0a 54 88 aa 81 be 89&n=
bsp; "Y........T.....<br>
0040 - e0 2e 74 71 8e c8 fd f7-9d 5c 99 15 42 23 47 cf&n=
bsp; ..tq.....\..B#G.<br>
0050 - 0d 56 97 10 f3 f8 02 fe-69 65 e6 1c fa 7d 96 fe&n=
bsp; .V......ie...}..<br>
0060 - 86 d2 c2 64 2c 6e 96 3d-14 e2 87 47 91 69 ef df&n=
bsp; ...d,n.=3D...G.i..<br>
0070 - 14 d5 75 0d ff da 61 04-26 56 5d 8b d3 4d 2d 2d&n=
bsp; ..u...a.&V]..M--<br>
0080 - 78 fa 65 6d ad ef 15 ba-14 45 f0 ba a6 85 fb 95&n=
bsp; x.em.....E......<br>
0090 - dc e5 9b 1c ac e4 66 de-c2 6e 3f e7 1e 47 09 25&n=
bsp; ......f..n?..G.%<br>
00a0 - 89 b0 c3 c0 4c 93 64 de-23 3e 58 67 ae f3 7e e4&n=
bsp; ....L.d.#>Xg..~.<br>
00b0 - d5 af 4d 31 40 24 87 da-ec e7 3f 8a 48 b5 9d 23&n=
bsp; ..M1@$....?.H..#<br>
00c0 - d4 53 01 fa 18 39 79 0f-9b 9c ea ed 71 63 c5 2f&n=
bsp; .S...9y.....qc./<br>
<br>
Start Time: 1556123794<br>
Timeout : 7200 (sec)<br>
Verify return code: 0 (ok)<br>
Extended master secret: no<br>
Max Early Data: 0<br>
---<br>
SSL_connect:SSLv3/TLS read server session ticket<br>
read R BLOCK<br>
SSL3 alert read:warning:close notify<br>
closed<br>
SSL3 alert write:warning:close notify<br>
vielle:/home/software/openldap-bug><br>
###<br>
<br>
There is no OpenLDAP bug here. Your server environment is broken.<br>
-- <br>
-- Howard Chu<br>
CTO, Symas Corp. &nbs=
p; <a href=3D"https://eur04.safelinks.protection.outlook.com/?url=3Dh=
ttp%3A%2F%2Fwww.symas.com&amp;data=3D02%7C01%7C%7Caca4f78e53324b5269000=
8d6c8d3cc09%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636917209315407238=
&amp;sdata=3DyzZvZLe34LJJfhMqjtBoGhJqMXnLSPdeBExlpYnMKqY%3D&amp;res=
erved=3D0">
https://eur04.safelinks.protection.outlook.com/?url=3Dhttp%3A%2F%2Fwww.syma=
s.com&amp;data=3D02%7C01%7C%7Caca4f78e53324b52690008d6c8d3cc09%7C84df9e=
7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636917209315407238&amp;sdata=3DyzZ=
vZLe34LJJfhMqjtBoGhJqMXnLSPdeBExlpYnMKqY%3D&amp;reserved=3D0</a><br>
Director, Highland Sun <a href=3D"https://eu=
r04.safelinks.protection.outlook.com/?url=3Dhttp%3A%2F%2Fhighlandsun.com%2F=
hyc%2F&amp;data=3D02%7C01%7C%7Caca4f78e53324b52690008d6c8d3cc09%7C84df9=
e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636917209315407238&amp;sdata=3Dc%=
2B1myt04g7sv1kXBUCwd1bUgQV4HGrjAgYgsPoAXLpA%3D&amp;reserved=3D0">
https://eur04.safelinks.protection.outlook.com/?url=3Dhttp%3A%2F%2Fhighland=
sun.com%2Fhyc%2F&amp;data=3D02%7C01%7C%7Caca4f78e53324b52690008d6c8d3cc=
09%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636917209315407238&amp;=
sdata=3Dc%2B1myt04g7sv1kXBUCwd1bUgQV4HGrjAgYgsPoAXLpA%3D&amp;reserved=
=3D0</a><br>
Chief Architect, OpenLDAP <a href=3D"https://eur04.safelinks.p=
rotection.outlook.com/?url=3Dhttp%3A%2F%2Fwww.openldap.org%2Fproject%2F&=
;amp;data=3D02%7C01%7C%7Caca4f78e53324b52690008d6c8d3cc09%7C84df9e7fe9f640a=
fb435aaaaaaaaaaaa%7C1%7C0%7C636917209315407238&amp;sdata=3DbMFyP0JzruNw=
nxXozQQnUVYg2WrYvQJ1PFDWdgkd6zc%3D&amp;reserved=3D0">
https://eur04.safelinks.protection.outlook.com/?url=3Dhttp%3A%2F%2Fwww.open=
ldap.org%2Fproject%2F&amp;data=3D02%7C01%7C%7Caca4f78e53324b52690008d6c=
8d3cc09%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636917209315407238&=
;amp;sdata=3DbMFyP0JzruNwnxXozQQnUVYg2WrYvQJ1PFDWdgkd6zc%3D&amp;reserve=
d=3D0</a><br>
</div>
</span></font></div>
</div>
</body>
</html>
--_000_MWHPR08MB2400F5334463D5A204E8CF88B53C0MWHPR08MB2400namp_--