https://bugs.openldap.org/show_bug.cgi?id=9195

Bug ID: 9195 Summary: Poor error messaging for TLS connect/accept with GnuTLS Product: OpenLDAP Version: 2.4.49 Hardware: All OS: All Status: UNCONFIRMED Severity: normal Priority: --- Component: libraries Assignee: bugs@openldap.org Reporter: ryan@openldap.org Target Milestone: ---

When doing something like:

./clients/tools/ldapsearch -H ldap://171.67.218.153 -ZZ -x

With OpenSSL we get:

ldap_start_tls: Connect error (-11) additional info: TLS: hostname does not match CN in peer certificate

With GnuTLS we just get:

ldap_start_tls: Connect error (-11) additional info: (unknown error code)

We can do better. My thoughts right now are:

1. stash the verify status in the session; 2. return a specific value to indicate verify failed; 3. have tlsg_session_errmsg recognize that value and print the detailed verification status.

GnuTLS 3.5 added GNUTLS_E_CERTIFICATE_VERIFICATION_ERROR, but I don't think it's worth bumping our required version for that alone. For the time being (i.e. 2.5) I'd like to keep 3.3 and maybe even 3.2 supported...