[Date Prev][Date Next]
Re: Problem with tls connections
On Fri, 5 Sep 2008, Norman Gies wrote:
> i have a problem with tls connections to my openldap server.
> The openldap server is running on debian. I created all certificates
> with openssl. If I use ldapsearch on the server (SASL//EXTERNAL mech/)
> everything works fine, but if i try to connect with jxplorer,
> ldapbrowser (softera), eclipse (apache directoy), or with the examples
> from jldap, i always got the same error:
> javax.net.ssl.SSLHandshakeException: Remote host closed connection
> during handshake
I'm guessing this is the usual LDAP-with-StartTLS-on-port-389 vs
Does jxplorer support the LDAP StartTLS operation, or does it only support
negotiating TLS/SSL at connect time? If both, are you sure you're
configuring it to use the right one? The slapd log you quoted shows a
connection on port 389, the normal LDAP port. If a client tries to
negotiate SSL at connection-time on that port, the LDAP server will hang
up on it, as the SSL handshake packets don't look like LDAP requests.
If the client only supports SSL-on-connect, then you need to have it
connect on port 636 (and you have to tell slapd to serve ldaps there too).