I&#39;m going to try these things shortly.<br><br>Quick question on how back-meta works, does it use the configuration in ldap.conf to do the backend proxying to the external LDAP server? My slapd.conf has a self signed ca/cert and stuff, but I have no visibility into the configuration of the external LDAP server that I have configured in the meta stanza in my 
slapd.conf. Do I need their cacert.pem file? Does the one I use in slapd.conf need to match the one on the external server? Does the one in my ldap.conf need to match theirs? Do I need to configure something in the &quot;meta&quot; stanza in my 
slapd.conf to tell it not to verify the external servers certificate?<br><br>The thing that confuses me the most if the fact that ldapwhoami works over ldaps:// to that external server, but the meta piece in my slapd.conf
 won&#39;t work over ldaps, only over straight ldap.<br><br>--stephen<br><br><div><span class="gmail_quote">On 1/24/07, <b class="gmail_sendername">Aaron Richton</b> &lt;<a href="mailto:richton@nbcs.rutgers.edu">richton@nbcs.rutgers.edu
</a>&gt; wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">OK, a couple long shots (I don&#39;t really believe these, but they should be
<br>quick to try and since you&#39;re not working anyway they shouldn&#39;t hurt)...<br><br>Do TLSCACertificateFile and/or TLSCACertificatePath match TLS_CACERT<br>and/or TLS_CACERTDIR? Can you make them that way?<br><br>
Can you verify somehow that the ldap.conf you expect to be read is indeed<br>being read? That there&#39;s no ~/.ldaprc in the way?<br><br>&quot;TLS_REQCERT never&quot; should set the library to its most liberal; it&#39;s<br>
somewhat surprising that it&#39;s still complaining about CA in that case.<br><br>On Wed, 24 Jan 2007, Stephen Agar wrote:<br><br>&gt; I appreciate everyone&#39;s advice, I have verified that as the same uid &quot;user<br>
&gt; ldap&quot;, i CAN connect to the external LDAP server via &quot;ldapwhoami over<br>&gt; ldaps://&quot; but when connecting to localhost and attempting to use the &quot;meta&quot;<br>&gt; definition, it doesn&#39;t work.
<br>&gt;<br>&gt; I don&#39;t have a copy of the cacert on the external server, i just have a self<br>&gt; signed setup on my own openldap box. Do I need to get a copy of their<br>&gt; cacert.pem and configure that in my ldap.conf
?<br>&gt;<br>&gt; I haven&#39;t had a chance to look at the strace/truss output yet, but will post<br>&gt; when I do.<br>&gt;<br>&gt; --stephen<br></blockquote></div><br>