[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: TLS fails

On Wednesday 15 February 2006 15:40, Jon Roberts wrote:
> Quanah Gibson-Mount wrote:
> > On Wednesday 15 February 2006 14:23, Ran Li wrote:
> >>>>The funny thing is, TLS works fine from a remote host, but not on the
> >>
> >>server itself. I tried changing localhost to the actual DNS name of the
> >>server, but still I get the same error.
> >>is the ldap server a ldap client? my understanding is it has to be a
> >>ldap client in order to make ldapsearch over tls work.
> >
> > You have to use the name in your search that matches the name in the
> > certificate for TLS to work.
> In JLDAP clients I can connect to a remote ldaps server by using the ip
> address as hostname, even though I obviously did not use the ip as the
> name in the certificate. Is that advice specific to ldapsearch,
> StartTLS, or something else I might be confused about?

I'm guessing that JLDAP translates the IP address to the FQDN.

ldapsearch -ZZZ -h uid=quanah uid
ldap_start_tls: Connect error (-11)
        additional info: error:14090086:SSL 
routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed


Quanah Gibson-Mount
Principal Software Developer
ITS/Shared Application Services
Stanford University
GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html