On 08/11/2009 04:44 AM, Howard Chu wrote:

Ed@vanGasteren.net wrote:

...

Full_Name: Ed van Gasteren Version: 2.4.12 and 2.4.15 OS: linux (Fedora 10, 11) URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (85.223.76.221)

On system lt2 (up to date Fedora 10) I run openldap (2.4.12) server and clients. The configuration is such that things work as expected even with security tightened up to "TLSVerifyClient demand". ldapsearch (either to -H ldaps or with -ZZ), nss and gq with TLS work like a charm.

On system lt1 (up to date Fedora 11) I run openldap clients (2.4.15), gq and Thunderbird connecting to the server on lt2. TLS/SSL only works if I run slapd with "-d 2". If I run slapd without it then ldapsearch hangs on "TLS trace: SSL_connect:SSLv3 read server certificate A".

Seems as if the normal code path has a flaw which gets corrected/bypassed by the debugging code.

Doesn't sound familiar, I've never had this problem. However, the TLS code was refactored in rev 2.4.14, and it's always possible we missed something in the churn. How does openssl s_client react under the same conditions? If it hangs the same way, then that points to a bug on the

Should have mentioned that. It indeed hangs the same way, in the middle of getting over the "Acceptable client certificate CA names".

The last debug info from s_client suggests it is getting less of the list then in expects:

read from 0x8c13300 [0x8c19915] (16384 bytes => 10395

The last one coming across correctly is:

/C=US/O=VeriSign, Inc./OU=Class 4 Public Primary Certification Authority - G2/OU=(c) 1998 VeriSign, Inc. - For authorized use only/OU=VeriSign Trust Network

The one not coming is:

/L=ValiCert Validation Network/O=ValiCert, Inc./OU=ValiCert Class 1 Policy Validation Authority/CN=http://www.valicert.com//emailAddress=info@valicert.com

server, and the answer is just to upgrade since .12 is rather out of

Hm! I'll see if I can get the 2.4.15 openldap stuff from Fedora 11 repo's running on lt2 first.

date now. If s_client works, then we probably have to look at our client code.