Full_Name: Rik Theys Version: 2.4.40 OS: Fedora 21 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (134.58.253.57)

Hi,

After upgrading from Fedora 20 to 21 my client machine could no longer connect to our LDAP server. Fedora links openldap with nss for TLS. It throws the following error:

TLS: certdb config: configDir='/etc/openldap/cacerts' tokenDescription='ldap(0)' certPrefix='' keyPrefix='' flags=readOnly TLS: cannot open certdb '/etc/openldap/cacerts', error -8018:Unknown PKCS #11 error. TLS: loaded CA certificate file /etc/openldap/cacerts/a9b3780c.0 from CA certificate directory /etc/openldap/cacerts. TLS: loaded CA certificate file /etc/openldap/cacerts/f4033bb2.0 from CA certificate directory /etc/openldap/cacerts. TLS: skipping 'cacert.pem' - filename does not have expected format (certificate hash with numeric suffix) TLS: skipping 'esat.pem' - filename does not have expected format (certificate hash with numeric suffix) TLS: certificate [CN=wheezy-test.esat.kuleuven.be,OU=ESAT,O=KU Leuven,ST=Leuven,C=BE] is valid TLS: error: connect - force handshake failure: errno 0 - moznss error -12256 TLS: can't connect: TLS error -12256:SSL received a malformed Certificate Request handshake message.. ldap_err2string ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)

I downgraded to fedora package 2.4.40-1.fc21 which did not have this bug.

The only difference between 2.4.40-1.fc21 and 2.4.40-2.fc21 is a backported patch for ITS #7979 which adds TLS 1+ support.

I tried to reproduce this on a test machine and was initially unable to reproduce it there. Comparing the config of the test machine with our failing LDAP servers only showed a difference for the olcTLSVerifyClient setting.

When the LDAP server does not have 'olcTLSVerifyClient: allow' in its configuration, it works. Once I set this parameter in the server configuration, the error above appears and LDAP connections are broken.

The patch looks OK so maybe there's something wrong when openldap uses a higher TLS version and the bug it to be found there?

I've also filed this bug in the fedora bug tracker: https://bugzilla.redhat.com/show_bug.cgi?id=1172638

Regards,

Rik