Re: Syncrepl SSL fail

[Hugo Deprez <hugo.deprez@gmail.com>]

Hello,

On the provider I have the following settings :

TLSCACertificateFile /etc/ssl/certs/ldap-cert.pem
TLSCertificateFile /etc/ssl/certs/ldap-cert.pem
TLSCertificateKeyFile /etc/ldap/ssl/ldap-key.pem

but no TLSCipherSuite defined.

I added the starttls=yes on the consumer :

Syncrepl  rid=003
             provider=ldaps://ldap.mydomain.fr:1024/
             type=refreshOnly
             retry="60 10 600 +"
             interval=00:00:00:10
             searchbase="dc=mydomain,dc=fr"
             scope=sub
             schemachecking=on
             bindmethod=simple
             starttls=yes
             tls_cert=/etc/ssl/certs/ldap-cert.pem
             tls_cacert=/etc/ssl/certs/ldap-cert-ca.pem
             binddn="cn=syncrepluser,o=others,dc=mydomain,dc=fr"
             credentials=my_password


But still the same error.

Any idea ?

Hugo
On 14 October 2011 13:52, Olivier Guillard <olivier@guillard.nom.fr> wrote:
> Hi,
>
> Have you set up the follwing appropriately :
>
> TLSCertificateFile
> TLSCertificateKeyFile
> TLSCipherSuite
>
> On the provider ?
>
> You probably also want to set this up correctly in
> your syncrepl section :
>
>  starttls=yes
>  tls_cacert=/path/to/certificate
>
> I suspect better if TLS_CACERT is also properly
> set up in both ldap server slapd config.
>
> ---
> Olivier
>
> On Thu, Oct 13, 2011 at 6:38 PM, Hugo Deprez <hugo.deprez@gmail.com> wrote:
>> Dear community,
>>
>> I setup a syncrepl between my master openldap server and a consumer.
>>
>> I am trying to use SSL for this syncrepl
>> I got the following error in the log  when I start slapd on the consumer :
>>
>> Oct 13 17:04:59 server slapd[16905]: slapd starting
>> Oct 13 17:04:59 server slapd[16905]: slap_client_connect:
>> URI=ldaps://ldap.mydomain.fr:1024/
>> DN="cn=syncrepluser,o=others,dc=mydomain,dc=fr" ldap_sasl_bind_s
>> failed (-1)
>> Oct 13 17:04:59 server slapd[16905]: do_syncrepl: rid=003 rc -1
>> retrying (9 retries left)
>>
>>
>> I don't understand why it is failing as a single ldapsearch from the
>> same server with the syncrepl user is working.
>>
>> here is my syncrepl configuration :
>>
>> Syncrepl  rid=003
>>               provider=ldaps://ldap.mydomain.fr:1024/
>>               type=refreshOnly
>>               retry="60 10 600 +"
>>               interval=00:00:00:10
>>               searchbase="dc=mydomain,dc=fr"
>>               scope=sub
>>               schemachecking=on
>>               bindmethod=simple
>>               binddn="cn=syncrepluser,o=others,dc=mydomain,dc=fr"
>>               credentials=my_password
>>
>>
>> Any idea ?
>>
>> Regards,
>>
>> Hugo
>>
>>
>