Re: ldap_set_option

[Howard Chu <hyc@symas.com>]

Sangita Mohan wrote:

> At 05:51 PM 5/11/2005, Howard Chu wrote:
>
> > Sangita Mohan wrote:
> >
> > > I am working on authentication via SSL. I am using the 
> > > ldap_set_option to set the path to the certificate file. I am able 
> > > to successfully authenticate when using the
> > >
> > > int rc = ldap_set_option(NULL, LDAP_OPT_X_TLS_CACERTFILE, 
> > > "C:\\Cert.cer");
> > >
> > > I also noticed the option LDAP_OPT_X_TLS_CACERTDIR. However it fails 
> > > when used by itself. I am having to set a dummy 
> > > LDAP_OPT_X_TLS_CACERTFILE before setting LDAP_OPT_X_TLS_CACERTDIR. 
> > > Is this correct?
> >
> >
> > Just use the CACERTFILE. See the ldap.conf(5) manpage for information 
> > on the CACERTDIR. For most sites it is useless.
>
>
> Thanks for the quick response. I understand that if the server 
> certificate is already trusted, I can set the path to the certificate 
> file.  I am looking at the scenario of a server certificate that is 
> not trusted but the user would like to add the certificate to the list 
> of trusted certificates and proceed with the LDAP query. I don't see 
> any API to get the actual certificate information to add it to my list 
> of trusted certificates and proceed. I see the option TLS_REQCERT that 
> would allow me to proceed with the query if the certificate is not 
> trusted. However is there any API that would allow me to see the 
> certificate information to make sure it is trusted and add it to my 
> trusted database?

Just to be clear, you're referring to trusted server certificates, but 
you should be talking about trusted CA certificates here, since those 
are what the CACERTDIR and CACERTFILE options are for. Clients should 
not be building lists of trusted servers at all. It seems to me that 
your questions would best be answered by reading some documentation on 
SSL/TLS, then after you've gained some high level understanding of how 
those mechanisms work, you can look at the OpenSSL API documentation to 
get specific details. None of this is particular to OpenLDAP software.

--
 -- Howard Chu
 Chief Architect, Symas Corp.       Director, Highland Sun
 http://www.symas.com               http://highlandsun.com/hyc
 Symas: Premier OpenSource Development and Support