Re: TLS handshake failure

[Rich Megginson <rich.megginson@gmail.com>]

On 08/09/2011 08:33 AM, Daniel Qian wrote:
> Hi,
>
> I have slapd 2.4.24 and everything works without TLS. but if I add a 
> -Z option to the ldapsearch command I get this:
>
> [root@ldaprov1 cacerts]# ldapsearch -x -LLL -b cn=config  -D 
> cn=admin,cn=config -wxxxxxxx -Z -H ldap://ldaprov1.prod cn=config
> ldap_start_tls: Connect error (-11)
> ldap_result: Can't contact LDAP server (-1)
>
> slapd.log shows something like this : connection_read(16): TLS accept 
> failure error=-1 id=1006, closing
>
> Output from openssl debug:
>
> [root@ldaprov1 cacerts]# openssl s_client -connect hostname:389 
> -showcerts -state -CAfile cacert.pem
> CONNECTED(00000003)
> SSL_connect:before/connect initialization
> SSL_connect:SSLv2/v3 write client hello A
> 140225133647680:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake 
> failure:s23_lib.c:177:
> ---
> no peer certificate available
> ---
> No client certificate CA names sent
> ---
> SSL handshake has read 0 bytes and written 113 bytes
> ---
> New, (NONE), Cipher is (NONE)
> Secure Renegotiation IS NOT supported
> Compression: NONE
> Expansion: NONE
> ---
>
> The configurations are as follow (same command as above but without 
> the -Z option):
>
> [root@ldaprov1 cacerts]# ldapsearch -x -LLL -b cn=config  -D 
> cn=admin,cn=config -wxxxxxx  -H ldap://hostname cn=config
> dn: cn=config
> objectClass: olcGlobal
> cn: config
> olcConfigFile: /etc/openldap/slapd.conf
> olcConfigDir: /etc/openldap/slapd.d
> olcAllows: bind_v2
> olcArgsFile: /var/run/openldap/slapd.args
> olcAttributeOptions: lang-
> olcAuthzPolicy: none
> olcConcurrency: 0
> olcConnMaxPending: 100
> olcConnMaxPendingAuth: 1000
> olcGentleHUP: FALSE
> olcIdleTimeout: 0
> olcIndexSubstrIfMaxLen: 4
> olcIndexSubstrIfMinLen: 2
> olcIndexSubstrAnyLen: 4
> olcIndexSubstrAnyStep: 2
> olcIndexIntLen: 4
> olcLocalSSF: 71
> olcLogLevel: 9
> olcPidFile: /var/run/openldap/slapd.pid
> olcReadOnly: FALSE
> olcReverseLookup: FALSE
> olcSaslSecProps: noplain,noanonymous
> olcSockbufMaxIncoming: 262143
> olcSockbufMaxIncomingAuth: 16777215
> olcThreads: 16
> olcTLSCACertificateFile: /etc/openldap/cacerts/cacert.pem
> olcTLSCertificateFile: /etc/openldap/cacerts/ldaprov1.crt
> olcTLSCertificateKeyFile: /etc/openldap/cacerts/ldaprov1.key
> olcTLSVerifyClient: never
> olcToolThreads: 1
> olcWriteTimeout: 0
>
>
> I verified the ldap user can read all the TLS files and they are setup 
> fine
>
> [root@ldaprov1 cacerts]# openssl verify -purpose sslserver -CAfile 
> cacert.pem ldaprov1.crt
> ldaprov1.crt: OK
>
>
> Anyone can tell me what I am missing here?
No, but we're missing
1) platform
2) tls implementation (openssl, moznss, gnutls)
3) output of ldapsearch -x -d 1 -Z ...... rest of arguments .....
> Thanks,
> Daniel