[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
Re: problem with syncrepl and STARTTLS
- To: r0m5 <r0m5@r0m5.eu>
- Subject: Re: problem with syncrepl and STARTTLS
- From: Ryan Tandy <ryan@nardis.ca>
- Date: Wed, 9 Aug 2017 10:54:52 -0700
- Cc: openldap-technical@openldap.org
- Content-disposition: inline
- Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nardis.ca; s=google; h=date:from:to:cc:subject:message-id:mail-followup-to:references :mime-version:content-disposition:in-reply-to:user-agent; bh=5aFVlkUVwHde3nKS5ORJi4xMbz8smEg+Xvuld6LmVPk=; b=ccMBVlQugv4yQrS1VETv3rvjhszqGSNH1SRmAUSp+bHVvHk+X/QHXkpq9CLlJNhh4w Kty0cuA53idXu8+ZG2bPoqwArnUtg5ekjoXv1pESMR0PwCwTvZ2CH61KuG9Ggv0sWRWs FXss10rD3D3LBtxtGfmeVdYzhmQ5Mn13vaLiw=
- In-reply-to: <2fd53b27-315c-db8a-f92b-c0eafe46092e@r0m5.eu>
- Mail-followup-to: r0m5 <r0m5@r0m5.eu>, openldap-technical@openldap.org
- References: <53769c53fc5149828588888c1e01fef7@de-rasse.fr> <WM!e0914311a8ee5b638d4fa3111b07fd1e5eda86092bafb4125eb9e9755ac34113ac92a6c67897631469170aef9b654d19!@mailstronghold-3.zmailcloud.com> <9E0EEC12AA9367D3132A710A@[192.168.1.19]> <59becf0c3113ec79983bd082ae8ae178@de-rasse.fr> <6ac78a9a2d6216fd345510b875a5c77d@r0m5.eu> <20170809163825.ybip7yg6cd6d45bk@kiwi.nardis.ca> <2fd53b27-315c-db8a-f92b-c0eafe46092e@r0m5.eu>
- User-agent: NeoMutt/20170113 (1.7.2)
On Wed, Aug 09, 2017 at 07:47:06PM +0200, r0m5 wrote:
Yes so far "TLS_REQCERT allow" on the PHP applications' OS because the
OpenLDAP consumers certs are still self-signed.
Indeed I saw #8385 linked in ITS#8427. From my understanding #8385 deals
with certificate validation using libldap. php5-ldap depends on libldap
and the versions of libldap install on our php frontends are old
(jessie...).
I'm actually about to propose an update for stretch including that fix
along with some others (and will update jessie-backports once it's
released for stretch). I hadn't intended to backport it as far as
jessie, but I have some other changes pending for jessie as well so I
may as well include it.
So I will also make sure that the PHP frontends trust the CA that will
sign the new LDAP consumer's certificates. I guess that should solve the
STARTTLS problems from application to consumer the same way it (looks
like it) solved the STARTTLS problems from consumers to providers.
Yes, it should.