Re: Subject Alternative Name in TLS - does this work?

[lejeczek <peljasz@yahoo.co.uk>]

On 10/18/2013 10:41 AM, Christian Kratzer wrote:
> Hi,
>
> On Thu, 17 Oct 2013, lejeczek wrote:
>
> > dear all
> >
> > I'm trying to set a seeminglysimple setup
> > having a box with openldap I want it to use TLS on both 
> > internal and external hostnames/IPs
> >
> > openldap was set up earlier and was/is working
> > I generate TLS certificate with SAN
> > everything seems working fine
> > but
> > when I ldapsearch on external fqdn/IP (which in the 
> > certificate is the subjectAltName) search fails
> > whereas it succeeds on internal fqdn(which is the 
> > hostname/ CN in the certificate)
> >
> > error is: additional info: TLS error -8157:Certificate 
> > extension not found.
> >
> > is such a scenario even possible? having very same DN 
> > being served on more than one name via TLS?
>
>
> If this is what you are looking for I can confirm that I 
> have a setup with ldaps:// and ldap:// with TLS that uses 
> subjectAltNames in the certificates.
>
> Relevant parts of the x509 cert with customer name obfuscated
>
> We have this on one server:
>
>         Subject: C=XX, ST=State, L=City, O=Company, 
> CN=ldap1.example.org
>        X509v3 Subject Alternative Name:
>         DNS:ldap1.example.org, DNS:ldap1, 
> DNS:ldap-cluster.example.org, DNS:ldap-cluster
>
> We have this on the other server:
>
>         Subject: C=XX, ST=State, L=City, O=Company, 
> CN=ldap2.example.org
>        X509v3 Subject Alternative Name:
>         DNS:ldap2.example.org, DNS:ldap2, 
> DNS:ldap-cluster.example.org, DNS:ldap-cluster
>
>
> We can connect to ldap-cluster.example.org just fine 
> independent of to which server the load balancer directs 
> the tcp connection to.
>
> This is using openldap-2.4.36

hi Christian

my case is, well should be a lot more simpler, one box with

slapd.local.domain
slap.public.external

and this one host I would like to be able to search through 
on/via both hostnames/IPs with TLS
so I issue myself and sign a certificate, CA issuer is 
CA.local.domain

Subject: .......... CN=slapd.local.domain/email.........
and
X509v3 Subject Alternative Name:
                DNS:slap.public.external, IP 
Address:ex.te.rn.al

ldapsearch -h slap.public.external -D 
cn=manager,dc=local,dc=domain ....
result:
TLS: hostname (slap.public.external) does not match common 
name in certificate (slapd.local.domain).
TLS: can't connect: TLS error -8157:Certificate extension 
not found..
ldap_start_tls: Connect error (-11)
    additional info: TLS error -8157:Certificate extension 
not found.

whereas:
ldapsearch -h slap.local.domain -D cn=manager,dc=local,dc=domain
works fine
could it be tools from be openldap-clients, a bug? Apache's 
ldap toolkit for Eclipse seems to work and connects to 
slap.public.external

??

btw, being novice with openssl, is there a way to print 
extensions thus SAN of a certificate?
I can print and see it on the request.

regards

> Greetings
> Christian