[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: Problem with ldaps:// when switching from 2.3 to 2.4

On Thu, Nov 12, 2009 at 09:17:12AM +0100, Tomasz Welman wrote:
[...]

> TLS: can't connect: Decryption has failed..
> ldap_err2string
> ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1)
> 
> 
> The gnutls-cli I've launched 3 times and the error messages differ, look:
> 
> [root@darthvader ~]# gnutls-cli --x509cafile /etc/ldap/cacerts/bp.cert -p 
> 636 bluepages.ibm.com
> Processed 1 CA certificate(s).
> Resolving 'bluepages.ibm.com'...
> Connecting to '9.17.186.253:636'...


> *** Fatal error: A TLS packet with unexpected length was received.
> *** Handshake has failed
> GNUTLS ERROR: A TLS packet with unexpected length was received.


> [root@darthvader ~]# gnutls-cli --x509cafile /etc/ldap/cacerts/bp.cert -p 
> 636 bluepages.ibm.com
> Processed 1 CA certificate(s).
> Resolving 'bluepages.ibm.com'...
> Connecting to '9.17.186.253:636'...


> *** Fatal error: A TLS packet with unexpected length was received.
> *** Handshake has failed
> GNUTLS ERROR: A TLS packet with unexpected length was received.


> [root@darthvader ~]# gnutls-cli --x509cafile /etc/ldap/cacerts/bp.cert -p 
> 636 bluepages.ibm.com
> Processed 1 CA certificate(s).
> Resolving 'bluepages.ibm.com'...
> Connecting to '9.17.186.253:636'...
> *** Fatal error: Decryption has failed.
> *** Handshake has failed
> GNUTLS ERROR: Decryption has failed.
> 

Seems like there is an error with the gnutls library rather than openldap.
Could you try to connect to the server with openssl s_client instead of
gnutls-cli?

-- 
Mathias Gug
Ubuntu Developer  http://www.ubuntu.com