Re: Cannot search usercertificate binary data with raw data

Michael Ströder wrote:

Howard Chu wrote:

...

Michael Ströder wrote:

...

But userCertificate has certificateExactMatch (2.5.13.34) defined as equality matching rule. This is *not* the octetStringMatch (2.5.13.17) matching rule.

It is legal to use an octet string for certificateExactMatch. In OpenLDAP the octet string is simply parsed and turned into a certificate assertion value and then matched as usual.

It does not work for me with 2.4.22. It's a cert which was downloaded from the directory.

My mistake. See RFC4523. The filter must use a matching assertion value, it cannot use the actual certificate.