[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
Re: Enabling TLS problem on openldap2-2.3.39
Philip Guenther wrote:
> On Wed, 21 Nov 2007, Keagle, Chuck wrote:
>> I have yet to even change the error messages when trying:
>>
>> # ldapsearch -x -Z -H ldap://testsvr.blv.boeing.com -b "" -s base
>> 'objectclass=*' '+' '*'
>> ldap_start_tls: Connect error (-11)
>> additional info: error:14090086:SSL
>> routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
>
> Looks to me like slapd is sending its cert, but either
> 1) it doesn't match the hostname in the URI (testsvr.blv.boeing.com), or
> 2) none of the CAs 'above' it are in the set of CAs trusted to ldapsearch.
>
> So, what's the output of
> openssl x509 -text -noout -in /path/to/servers/cert/here.pem
I'd recommend to also configure LDAPS on separate port 636 by starting with
slapd -H "ldap://... ldaps://..."
and then use command
openssl s_client with either command-line option -CApath or -CAfile
to check whether everything is in place at the SSL/TLS level. openssl
s_client gives you nice debug log right to the console. If everything's
working then startTLS ext. op. should also work.
Ciao, Michael.
--
Michael Ströder
E-Mail: michael@stroeder.com
http://www.stroeder.com