[Date Prev][Date Next]
OpenLDAP cannot start if some TLS cert value gets invalid
- To: openldap-technical <email@example.com>
- Subject: OpenLDAP cannot start if some TLS cert value gets invalid
- From: Nick Milas <firstname.lastname@example.org>
- Date: Sun, 12 Feb 2012 16:24:42 +0200
- User-agent: Mozilla/5.0 (Windows NT 5.1; rv:10.0) Gecko/20120129 Thunderbird/10.0
I found out that if, in a working OpenLDAP installation, we
inadvertently change the value of:
to some invalid value, like:
then OpenLDAP continues to work (and we see no error message
whatsoever), but if it is stopped, it refuses to restart. In the logs,
while OpenLDAP is starting, we see:
Feb 11 16:20:44 vdev slapd: main: TLS init def ctx failed: -1
and then service is immediately stopped.
I believe that in such cases at least OpenLDAP could start without TLS
support, logging the problem and not being unable to restart.
The same should hold true for the other associated attributes
(olcTLSCACertificateFile, olcTLSCertificateFile), for which I didn't
A workaround if this happens (because, since OpenLDAP server is not
running, we cannot easily change the dynamic config) could be to create
a symbolic link (/path/to/non/existing/key.pem)to the true file
(/path/to/working/key.pem), and thus OpenLDAP can start.