Hi!
I need some assistance regarding TLS configuration. So, I'm using OpenLDAP 2.4.11 with debian/testing. This what my config looks like: slapd.conf: [...] TLSCACertificateFile /etc/ssl/certs/ecentrum_cacert.pem TLSCertificateFile /etc/ldap/tls/openldap_cert.pem TLSCertificateKeyFile /etc/ldap/tls/openldap_key.pem TLSVerifyClient try [...]
Slapd starts with these settings gladly, and with a client (eg. ldapsearch) without requesting TLS connection, I can get to the invalid credentials error (which is what I'm expecting now, this is just testing.). But with requesting TLS:
$ cat ~/.ldaprc TLS_CACERT /etc/ssl/certs/ecentrum_cacert.pem $ ls -l /etc/ssl/certs/ecentrum_cacert.pem -rw-r--r-- 1 root root [...] /etc/ssl/certs/ecentrum_cacert.pem
$ ldapsearch -d 1 -ZZWx '(objectclass=*)' \ -H ldap://fileserver.digiszfv:636 ldap_url_parse_ext(ldap://fileserver.digiszfv:636)
ldap_create
ldap_url_parse_ext(ldap://fileserver.digiszfv:636/??base)
ldap_extended_operation_s
ldap_extended_operation
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP fileserver.digiszfv:636
ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 192.168.1.3:636 ldap_pvt_connect: fd: 3 tm: -1 async: 0 ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({) ber: ber_flush2: 31 bytes to sd 3 ldap_result ld 0x67e0b0 msgid 1 wait4msg ld 0x67e0b0 msgid 1 (infinite timeout) wait4msg continue ld 0x67e0b0 msgid 1 all 1 ** ld 0x67e0b0 Connections: * host: fileserver.digiszfv port: 636 (default) refcnt: 2 status: Connected last used: Mon Oct 27 11:07:53 2008
** ld 0x67e0b0 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x67e0b0 request count 1 (abandoned 0) ** ld 0x67e0b0 Response Queue: Empty ld 0x67e0b0 response count 0 ldap_chkResponseList ld 0x67e0b0 msgid 1 all 1 ldap_chkResponseList returns ld 0x67e0b0 NULL ldap_int_select read1msg: ld 0x67e0b0 msgid 1 all 1 ber_get_next ldap_free_connection 1 0 ldap_free_connection: actually freed ldap_err2string ldap_start_tls: Can't contact LDAP server (-1)
Meanwhile on the server side: # tail -f syslog slapd[3779]: slap_listener_activate(9): slapd[3779]: >>> slap_listener(ldaps://fileserver.digiszfv:636/) slapd[3779]: connection_get(15): got connid=21 slapd[3779]: connection_read(15): checking for input on id=21 slapd[3779]: connection_read(15): TLS accept failure error=-1 id=21, closing slapd[3779]: connection_closing: readying conn=21 sd=15 for close slapd[3779]: connection_close: conn=21 sd=15
The log messages are so terse and/or cryptic, I simply can not figure out what could be wrong. Any help would be appreciated!
Thanks!
Daniel