[Date Prev][Date Next] [Chronological] [Thread] [Top]

TLS problems with openldap


I need some assistance regarding TLS configuration.
So, I'm using OpenLDAP 2.4.11 with debian/testing.
This what my config looks like:
TLSCACertificateFile    /etc/ssl/certs/ecentrum_cacert.pem
TLSCertificateFile      /etc/ldap/tls/openldap_cert.pem
TLSCertificateKeyFile   /etc/ldap/tls/openldap_key.pem
TLSVerifyClient         try

Slapd starts with these settings gladly, and with a client (eg. ldapsearch) without requesting TLS connection, I can get to the invalid credentials error (which is what I'm expecting now, this is just testing.).
But with requesting TLS:

$ cat ~/.ldaprc
TLS_CACERT /etc/ssl/certs/ecentrum_cacert.pem
$ ls -l /etc/ssl/certs/ecentrum_cacert.pem
-rw-r--r-- 1 root root [...] /etc/ssl/certs/ecentrum_cacert.pem

$ ldapsearch -d 1 -ZZWx '(objectclass=*)' \
-H ldap://fileserver.digiszfv:636






ldap_new_connection 1 1 0


ldap_connect_to_host: TCP fileserver.digiszfv:636

ldap_new_socket: 3
ldap_prepare_socket: 3
ldap_connect_to_host: Trying
ldap_pvt_connect: fd: 3 tm: -1 async: 0
ldap_open_defconn: successful
ber_scanf fmt ({it) ber:
ber_scanf fmt ({) ber:
ber_flush2: 31 bytes to sd 3
ldap_result ld 0x67e0b0 msgid 1
wait4msg ld 0x67e0b0 msgid 1 (infinite timeout)
wait4msg continue ld 0x67e0b0 msgid 1 all 1
** ld 0x67e0b0 Connections:
* host: fileserver.digiszfv  port: 636  (default)
  refcnt: 2  status: Connected
  last used: Mon Oct 27 11:07:53 2008

** ld 0x67e0b0 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x67e0b0 request count 1 (abandoned 0) ** ld 0x67e0b0 Response Queue: Empty ld 0x67e0b0 response count 0 ldap_chkResponseList ld 0x67e0b0 msgid 1 all 1 ldap_chkResponseList returns ld 0x67e0b0 NULL ldap_int_select read1msg: ld 0x67e0b0 msgid 1 all 1 ber_get_next ldap_free_connection 1 0 ldap_free_connection: actually freed ldap_err2string ldap_start_tls: Can't contact LDAP server (-1)

Meanwhile on the server side: # tail -f syslog slapd[3779]: slap_listener_activate(9): slapd[3779]: >>> slap_listener(ldaps://fileserver.digiszfv:636/) slapd[3779]: connection_get(15): got connid=21 slapd[3779]: connection_read(15): checking for input on id=21 slapd[3779]: connection_read(15): TLS accept failure error=-1 id=21, closing slapd[3779]: connection_closing: readying conn=21 sd=15 for close slapd[3779]: connection_close: conn=21 sd=15

The log messages are so terse and/or cryptic, I simply can not figure out what could be wrong.
Any help would be appreciated!



LEVAI Daniel
PGP key ID = 0x4AC0A4B1
Key fingerprint = D037 03B9 C12D D338 4412  2D83 1373 917A 4AC0 A4B1