[Date Prev][Date Next]
ldapsearch allows SSL even w/o correct TLS_CACERT
How is TLS_CACERT supposed to work? PADL's
tls_cacertfile/tls_checkpeer works for rejecting bad SSL
certs, but OpenLDAP's TLS_CACERT/TLS_REQCERT don't seem to
do the same -- if TLS_CACERT isn't the cert for the server's
CA, no error occurs, whereas I was expecting to see it fail.
The absence of TLS_CACERT allows all connections as well,
only pointing TLS_CACERT to a directory (as an
expecting-failure test) will cause the connection to fail.
Any suggestions? I am trying to supply a single CA cert to
OpenLDAP so as to use self-signed certs legitimately (which
works fine with PADL's pam/nss libs).