I am new to Openldap and TLS/SSL. I have two small
test programs (see details below). The first uses ldap_init the second
ldap_initalize. My observation is:

1) Using ldap_init, ldap_start_tls_s and set LDAP_OPT_X_TLS_ALLOW (empty
ldap.conf)
    It does not connect on port 389 nor 636

2) Using ldap_init,ldap_start_tls_s and set LDAP_OPT_X_TLS_ALLOW (emprty
ldap.conf and only TLS_REQCERT ALL in ldaprc)
    It does not connect on port 636 but it does on port 389

3) Using ldap_initialize and set LDAP_OPT_X_TLS_ALLOW (empty ldap.conf)
    It does not connect on port 389 nor 636

4) Using ldap_initialize and set LDAP_OPT_X_TLS_ALLOW (empty ldap.conf and

only TLS_REQCERT ALL in ldaprc)
        It does not connect on port 389 but it does on port 636

My first question is why does

val = LDAP_OPT_X_TLS_ALLOW;
ldap_set_option (ld, LDAP_OPT_X_TLS, &val);

not work ?

Secondly why behaves ldap_init different to ldap_initialize ?

Thirdly what do I need to do to be able to use TLS/SSL on either port 389
or
636 ?

Thank you
Markus

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

ldap_debug = -1 /*LDAP_DEBUG_ANY */ ;
(void) ldap_set_option(NULL, LDAP_OPT_DEBUG_LEVEL, &ldap_debug);

if (strstr(argv[1],"://") ) {
hostname=strstr(argv[1],"://")+3;
ssl=strstr(argv[1],"ldaps://");
host=strdup(hostname);
port=389;
if ((p=strchr(host,':'))) {
      *p='\0';
     p++;
     port=atoi(p);
    }
}
ld = (LDAP *)ldap_init(host,port);
val = LDAP_VERSION3;
(void)ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &val);
(void)ldap_set_option(ld, LDAP_OPT_REFERRALS , LDAP_OPT_ON);
ldap_start_tls_s(ld, NULL, NULL);
val = LDAP_OPT_X_TLS_ALLOW;
ldap_set_option (ld, LDAP_OPT_X_TLS, &val);
.
.
.

./ldap_test ldaps://w2k3.windows2003.home:636
"DC=WINDOWS2003,DC=HOME""CN=Markus,CN=USERS,DC=WINDOWS2003,DC=HOME" Passwd
ldap_create
ldap_extended_operation_s
ldap_extended_operation
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP w2k3.windows2003.home:636
ldap_new_socket: 4
ldap_prepare_socket: 4
ldap_connect_to_host: Trying 192.168.1.5:636
ldap_connect_timeout: fd: 4 tm: -1 async: 0
ldap_open_defconn: successful
ldap_send_server_request
ldap_result ld 8065c90 msgid 1
ldap_chkResponseList ld 8065c90 msgid 1 all 1
ldap_chkResponseList returns ld 8065c90 NULL
wait4msg ld 8065c90 msgid 1 (infinite timeout)
wait4msg continue ld 8065c90 msgid 1 all 1
** ld 8065c90 Connections:
* host: w2k3.windows2003.home port: 636 (default)
refcnt: 2 status: Connected
last used: Tue Jun 5 23:02:11 2007

** ld 8065c90 Outstanding Requests:
* msgid 1, origid 1, status InProgress
   outstanding referrals 0, parent count 0
** ld 8065c90 Response Queue:
   Empty
ldap_chkResponseList ld 8065c90 msgid 1 all 1
ldap_chkResponseList returns ld 8065c90 NULL
ldap_int_select
read1msg: ld 8065c90 msgid 1 all 1
ber_get_next failed.
ldap_err2string
ldap_test Error while setting start_tls for ldap server: Can't contact
LDAPserver
ldap_free_request (origid 1, msgid 1)ldap_free_connection 1 1
ldap_send_unbind
ldap_free_connection: actually freed

./ldap_test ldaps://w2k3.windows2003.home:389
"DC=WINDOWS2003,DC=HOME""CN=Markus,CN=USERS,DC=WINDOWS2003,DC=HOME" Passwd
ldap_createldap_extended_operation_s
ldap_extended_operation
ldap_send_initial_requestldap_new_connection 1 1 0
ldap_int_open_connectionldap_connect_to_host: TCP
w2k3.windows2003.home:389
ldap_new_socket: 4
ldap_prepare_socket: 4
ldap_connect_to_host: Trying 192.168.1.5:389
ldap_connect_timeout: fd: 4 tm: -1 async: 0
ldap_open_defconn: successful
ldap_send_server_request
ldap_result ld 8065c90 msgid 1
ldap_chkResponseList ld 8065c90 msgid 1 all 1
ldap_chkResponseList returns ld 8065c90 NULL
wait4msg ld 8065c90 msgid 1 (infinite timeout)
wait4msg continue ld 8065c90 msgid 1 all 1
** ld 8065c90 Connections:
* host: w2k3.windows2003.home port: 389 (default)
refcnt: 2 status: Connected
last used: Tue Jun 5 23:00:34 2007
** ld 8065c90 Outstanding Requests:
* msgid 1, origid 1, status InProgress
   outstanding referrals 0, parent count 0
** ld 8065c90 Response Queue:
   Empty
ldap_chkResponseList ld 8065c90 msgid 1 all 1
ldap_chkResponseList returns ld 8065c90 NULL
ldap_int_select
read1msg: ld 8065c90 msgid 1 all 1
read1msg: ld 8065c90 msgid 1 message type extended-result
new result: res_errno: 0, res_error: <>, res_matched: <>
read1msg: ld 8065c90 0 new referrals
read1msg: mark request completed, ld 8065c90 msgid 1
request done: ld 8065c90 msgid 1
res_errno: 0, res_error: <>, res_matched: <>
ldap_free_request (origid 1, msgid 1)
ldap_free_connection 0 1
ldap_free_connection: refcnt 1
ldap_parse_extended_result
ldap_parse_result
ldap_msgfree
TLS trace: SSL_connect:before/connect initialization
TLS trace: SSL_connect:SSLv2/v3 write client hello A
TLS trace: SSL_connect:SSLv3 read server hello A
TLS certificate verification: depth: 0, err: 20,
subject:/CN=w2k3.windows2003.home,
issuer:/DC=home/DC=windows2003/CN=Windows2003CA
TLS certificate verification: Error, unable to get local issuer
certificate
TLS trace: SSL3 alert write:fatal:unknown CA
TLS trace: SSL_connect:error in SSLv3 read server certificate B
TLS trace: SSL_connect:error in SSLv3 read server certificate B
TLS: can't connect.
ldap_err2string
ldap_free_connection 1 1
ldap_send_unbind
ldap_free_connection: actually freed

With ~/.ldaprc

TLS_REQCERT ALLOW

./ldap_test ldaps://w2k3.windows2003.home:389
"DC=WINDOWS2003,DC=HOME""CN=Markus,CN=USERS,DC=WINDOWS2003,DC=HOME" Passwd
ldap_createldap_extended_operation_sldap_extended_operationldap_send_initial_requestldap_new_connection
1 1 0ldap_int_o
pen_connection
ldap_connect_to_host: TCP w2k3.windows2003.home:389
ldap_new_socket: 4ldap_prepare_socket: 4
ldap_connect_to_host: Trying 192.168.1.5:389
ldap_connect_timeout: fd: 4 tm: -1 async: 0ldap_open_defconn: successful
ldap_send_server_request
ldap_result ld 8065c90 msgid 1
ldap_chkResponseList ld 8065c90 msgid 1 all 1
ldap_chkResponseList returns ld 8065c90 NULL
wait4msg ld 8065c90 msgid 1 (infinite timeout)
wait4msg continue ld 8065c90 msgid 1 all 1
** ld 8065c90 Connections:
* host: w2k3.windows2003.home port: 389 (default)
refcnt: 2 status: Connected
last used: Tue Jun 5 23:04:26 2007

** ld 8065c90 Outstanding Requests:
* msgid 1, origid 1, status InProgress
   outstanding referrals 0, parent count 0
** ld 8065c90 Response Queue:
   Empty
ldap_chkResponseList ld 8065c90 msgid 1 all 1
ldap_chkResponseList returns ld 8065c90 NULL
ldap_int_select
read1msg: ld 8065c90 msgid 1 all 1
read1msg: ld 8065c90 msgid 1 message type extended-result
new result: res_errno: 0, res_error: <>, res_matched: <>
read1msg: ld 8065c90 0 new referrals
read1msg: mark request completed, ld 8065c90 msgid 1
request done: ld 8065c90 msgid 1res_errno: 0, res_error: <>, res_matched:
<>
ldap_free_request (origid 1, msgid 1)
ldap_free_connection 0 1
ldap_free_connection: refcnt 1
ldap_parse_extended_result
ldap_parse_result
ldap_msgfree
TLS trace: SSL_connect:before/connect initialization
TLS trace: SSL_connect:SSLv2/v3 write client hello A
TLS trace: SSL_connect:SSLv3 read server hello A
TLS certificate verification: depth: 0, err: 20,
subject:/CN=w2k3.windows2003.home, issuer:
/DC=home/DC=windows2003/CN=Windows2003CA
TLS certificate verification: Error, unable to get local issuer
certificateTLS certificate verification: depth: 0, err: 27,

subject:/CN=w2k3.windows2003.home, issuer:
/DC=home/DC=windows2003/CN=Windows2003CA
TLS certificate verification: Error, certificate not trusted
TLS certificate verification: depth: 0, err: 21,
subject:/CN=w2k3.windows2003.home, issuer:
/DC=home/DC=windows2003/CN=Windows2003CA
TLS certificate verification: Error, unable to verify the first
certificate
TLS trace: SSL_connect:SSLv3 read server certificate A
TLS trace: SSL_connect:SSLv3 read server certificate request A
TLS trace: SSL_connect:SSLv3 read server done A
TLS trace: SSL_connect:SSLv3 write client certificate A
TLS trace: SSL_connect:SSLv3 write client key exchange A
TLS trace: SSL_connect:SSLv3 write change cipher spec A
TLS trace: SSL_connect:SSLv3 write finished A
TLS trace: SSL_connect:SSLv3 flush data
TLS trace: SSL_connect:SSLv3 read finished A
TLS trace: SSL3 alert write:warning:bad certificate
TLS: unable to get peer ertificate.
ldap_simple_bind_s
ldap_sasl_bind_s
ldap_sasl_bind
ldap_send_initial_request
ldap_send_server_request
ldap_result ld 8065c90 msgid 2
ldap_chkResponseList ld 8065c90 msgid 2 all 1
ldap_chkResponseList returns ld 8065c90 NULL
wait4msg ld 8065c90 msgid 2 (infinite timeout)
wait4msg continue ld 8065c90 msgid 2 all 1
** ld 8065c90 Connections:
* host: w2k3.windows2003.home port: 389 (default)
refcnt: 2 status: Connected
last used: Tue Jun 5 23:04:26 2007
** ld 8065c90 Outstanding Requests:
* msgid 2, origid 2, status InProgress
   outstanding referrals 0, parent count 0
** ld 8065c90 Response Queue:   Empty

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
ldap_debug = -1 /*LDAP_DEBUG_ANY */ ;
(void) ldap_set_option(NULL, LDAP_OPT_DEBUG_LEVEL, &ldap_debug);
ldap_initialize(ld,argv[1]);
val = LDAP_VERSION3;
(void)ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &val);
(void)ldap_set_option(ld, LDAP_OPT_REFERRALS , LDAP_OPT_ON);
val = LDAP_OPT_X_TLS_ALLOW;
ldap_set_option (ld,LDAP_OPT_X_TLS, &val);
.
.
.

./ldap_test ldaps://w2k3.windows2003.home:636
"DC=WINDOWS2003,DC=HOME""CN=Markus,CN=USERS,DC=WINDOWS2003,DC=HOME" Passwd
ldap_create
ldap_url_parse_ext(ldaps://w2k3.windows2003.home:636)
ldap_err2string
ldap_simple_bind_s
ldap_sasl_bind_s
ldap_sasl_bind
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP w2k3.windows2003.home:636
ldap_new_socket: 4
ldap_prepare_socket: 4
ldap_connect_to_host: Trying 192.168.1.5:636
ldap_connect_timeout: fd: 4 tm: -1 async: 0
TLS trace: SSL_connect:before/connect initialization
TLS trace: SSL_connect:SSLv2/v3 write client hello A
TLS trace: SSL_connect:SSLv3 read server hello A
TLS certificate verification: depth: 0, err: 20,
subject:/CN=w2k3.windows2003.home,
issuer:/DC=home/DC=windows2003/CN=Windows2003CA
TLS certificate verification: Error, unable to get local issuer
certificate
TLS trace: SSL3 alert write:fatal:unknown CA
TLS trace: SSL_connect:error in SSLv3 read server certificate B
TLS trace: SSL_connect:error in SSLv3 read server certificate B
TLS: can't connect.
ldap_err2string Can'tcontact LDAP server

./ldap_test ldaps://w2k3.windows2003.home:389
"DC=WINDOWS2003,DC=HOME""CN=Markus,CN=USERS,DC=WINDOWS2003,DC=HOME" Passwd
ldap_create
ldap_url_parse_ext(ldaps://w2k3.windows2003.home:389)
ldap_err2string
ldap_simple_bind_s
ldap_sasl_bind_s
ldap_sasl_bind
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP w2k3.windows2003.home:389
ldap_new_socket: 4
ldap_prepare_socket: 4
ldap_connect_to_host: Trying 192.168.1.5:389
ldap_connect_timeout: fd: 4 tm: -1 async: 0
TLS trace: SSL_connect:before/connect initialization
TLS trace: SSL_connect:SSLv2/v3 write client hello A
TLS: can't connect.
ldap_err2string Can'tcontact LDAP server

With ~/.ldaprc
TLS_REQCERT ALLOW

./ldap_test ldaps://w2k3.windows2003.home:636
"DC=WINDOWS2003,DC=HOME""CN=Markus,CN=USERS,DC=WINDOWS2003,DC=HOME" Passwd
ldap_create
ldap_url_parse_ext(ldaps://w2k3.windows2003.home:636)
ldap_err2string
ldap_simple_bind_s
ldap_sasl_bind_s
ldap_sasl_bind
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP w2k3.windows2003.home:636
ldap_new_socket: 4
ldap_prepare_socket: 4
ldap_connect_to_host: Trying 192.168.1.5:636
ldap_connect_timeout: fd: 4 tm: -1 async: 0
TLS trace: SSL_connect:before/connect initialization
TLS trace: SSL_connect:SSLv2/v3 write client hello A
TLS trace: SSL_connect:SSLv3 read server hello A
TLS certificate verification: depth: 0, err: 20,
subject:/CN=w2k3.windows2003.home, issuer:
/DC=home/DC=windows2003/CN=Windows2003CA
TLS certificate verification: Error, unable to get local issuer
certificateTLS certificate verification: depth: 0, err: 27,

subject:/CN=w2k3.windows2003.home, issuer:
/DC=home/DC=windows2003/CN=Windows2003CA
TLS certificate verification: Error, certificate not trusted
TLS certificate verification: depth: 0, err: 21,
subject:/CN=w2k3.windows2003.home, issuer:
/DC=home/DC=windows2003/CN=Windows2003CA
TLS certificate verification: Error, unable to verify the first
certificateTLS trace: SSL_connect:SSLv3 read server certificate A
TLS trace: SSL_connect:SSLv3 read server certificate request A
TLS trace: SSL_connect:SSLv3 read server done A
TLS trace: SSL_connect:SSLv3 write client certificate A
TLS trace: SSL_connect:SSLv3 write client key exchange A
TLS trace: SSL_connect:SSLv3 write change cipher spec ATLS trace:
SSL_connect:SSLv3 write finished A
TLS trace: SSL_connect:SSLv3 flush data
TLS trace: SSL_connect:SSLv3 read finished A
TLS trace: SSL3 alert write:warning:bad certificate
TLS: unable to get peer certificate.
ldap_open_defconn: successful
ldap_send_server_request
ldap_result ld 8065c58 msgid 1
ldap_chkResponseList ld 8065c58 msgid 1 all 1
ldap_chkResponseList returns ld 8065c58 NULL
wait4msg ld 8065c58 msgid 1 (infinite timeout)
wait4msg continue ld 8065c58 msgid 1 all 1
** ld 8065c58 Connections:
* host: w2k3.windows2003.home port: 636 (default)
refcnt: 2 status: Connected
last used: Tue Jun 5 22:55:02 2007
** ld 8065c58 Outstanding Requests:
* msgid 1, origid 1, status InProgress
   outstanding referrals 0, parent count 0
** ld 8065c58 Response Queue:
   Empty