[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: openldap tls problem

Please check your ldap server.
How it was started? Check the port number. port must be 636.
Your apache might have the root-CA certificate which is validating your globalsign-domainssl.pem.
May be your client is failing to get the entire chain of certificates.
Make sure that /etc/openldap/ldap.conf has the TLS_CACERTDIR clause where all the certificates are present.
Use certificate-rehash utility to hash the certificates in the cert-directory.
I used to start my server using command
/usr/sbin/slapd -f /etc/openldap/slapd.conf -d 127 -h ldaps:/// &
And to search the user I use
ldapsearch -x -H ldaps://ldapserverFQDN:636 -b "dc=my-domain,dc=com"
Digambar Yashwant Sawant

On Fri, Sep 12, 2008 at 4:51 PM, Michael Fischer <michi.fischer@gmx.net> wrote:

i hope this is the right list for my problem, if not sorry in advance.

i want to configure slapd to use tls. i have a certifikate signed by
globalsign and the following lines in my slapd.conf:

TLSCertificateFile /etc/postfix/certs/ldap.pem
TLSCertificateKeyFile /etc/postfix/certs/ldap.key
TLSCACertificateFile /etc/postfix/certs/globalsign-domainssl.pem

but when issuing a ldapsearch on another machine i still get an error:
# ldapsearch -bdc=xxx,dc=at -Dcn=admin,dc=xxx,dc=at -hldap.xxx.at -p389
-x -W -ZZ -d5 objectClass=*
TLS trace: SSL_connect:before/connect initialization
TLS trace: SSL_connect:SSLv2/v3 write client hello A
TLS trace: SSL_connect:SSLv3 read server hello A
TLS certificate verification: depth: 2, err: 19, subject: /C=US/O=GTE
Corporation/OU=GTE CyberTrust Solutions, Inc./CN=GTE CyberTrust Global
Root, issuer: /C=US/O=GTE Corporation/OU=GTE CyberTrust Solutions,
Inc./CN=GTE CyberTrust Global Root
TLS certificate verification: Error, self signed certificate in
certificate chain
TLS trace: SSL3 alert write:fatal:unknown CA
TLS trace: SSL_connect:error in SSLv3 read server certificate B
TLS trace: SSL_connect:error in SSLv3 read server certificate B
TLS: can't connect.
ldap_start_tls: Connect error (-11)
       additional info: error:14090086:SSL
routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

the same globalsign-certificates work well with my apache.

any hints?

lg, Michael Fischer
email: michi.fischer@gmx.net
web: http://www.webfischer.at