[Date Prev][Date Next]
Re: OpenLDAP-2.1.29 Replication over SSL
I know this question has been posed previously, but I haven't been able to
configure replication via SSL successfully.
Here's my environment:
One Master server
One Slave server
Both running OpenLDAP 2.1.29
I followed the "OpenLDAP SSL/TLS How-To"
instructions to create my own CA Issued Certificate and server cert and
I also created a client cert and key.
At this point the Master is set up to receive LDAP traffic over port 636,
the client ( in this case the slave machine) can connect just fine using
ldapsearch, ldapmodify, etc.
I then set up the SLAVE server to accept ldap traffic via SSL is the same
Create the ca on the SLAVE
Create the SLAVE-cacert.pem, SLAVE-servercrt.pem, and SLAVE-serverkey.pem.
Create a client cert and key. ldap.master.client.cert.pem and
Add the following to the SLAVE servers slapd.conf file
then add the following to the ldap.conf file on the master
add the following to the ldaprc file
Again, the master can connect to the slave (via SSL) using ldapsearch,
I set up the MASTER slapd.conf for replication
configure the SLAVE slapd.conf for replication/referrals
At this point I restarted both LDAP servers and was able to connect to
each one using ldapsearch from some client via SSL.
Referrals work fine (although NOT over port 636), but replication does
If I switch the 'replica uri=ldap://servername' is works fine, on port
I read in the list by Howard Chu:
"Since you have two different self-signed certs, one for master and one
you should cat them both into a single file. Then, in slapd.conf of both
master and slave you should specify TLSCACertificateFile with the file you
I should also have said "this is a stupid thing to do."
So I concatenated both the slave and master cacert.pem files into ONE file
(/usr/var/openldap-data/cacert.pem) and changed BOTH the master and slave
slapd.conf files to useThis is a basic question about how SSL and PKI works. You need to
already understand these topics before trying to use SSL with any
particular system (such as OpenLDAP). It is not the job of the OpenLDAP
Project to teach you how SSL works. Nevertheless, the 2.2 Admin Guide
spells out quite clearly where all of the certs need to go.
it's the same file on both machines, it's the two cacert.pem files
concatentated together into one file. everything else remains the same.
Restart ldap on both servers.
I can connect from slave to master via ssl using ldapsearch.
I can connect from mast to slave via ssl using ldapsearch
(ex. ldapsearch -LLL -H ldaps://master.domain.com .......)
referrals still work, but replication does not.
I'm receiving these messages on the master server in the /var/log/messages
slurpd: Initializing session to ldaps://slave.domain.com
slurpd: bind to slave.domain.com:636 as
slurpd: TLS: can't connect.
slurpd: Error: ldap_simple_bind_s for slave.domain.com:636 failed: Can't
contact LDAP server
On the slave I'm receiving (in the ldap.log file)
slapd: conn=45 fd=8 ACCEPT from IP=192.168.100.1:35608
slapd: conn=45 fd=8 closed
using ethereal on the slave server I see the master trying to initiate an
SSL connection, but it's getting a TLS handshake failure.
Can someone tell me where I'm going wrong?
I'm guessing it's my SSL configuration, but I'm not sure where to start.
Do I need to issue ALL the certificates and keys from ONE ca? If so which
certs/keys go where?
Thank you for your anticipated help!
CONFIDENTIALITY NOTICE: This e-mail, including attachments, is for the sole use of the individual to whom it is addressed. This message is confidential and may contain information that is privileged, confidential and is exempt from disclosure under applicable law. Any unauthorized review, use, disclosure or distribution is prohibited. If you have received this e-mail in error, please notify the sender by reply e-mail and destroy this message and its attachments.
Alas, this email has been disclosed and distributed.
-- Howard Chu
Chief Architect, Symas Corp. Director, Highland Sun
Symas: Premier OpenSource Development and Support