My cert on my LDAP server contains multiple commonName entries.
openssl x509 -noout -in s014-ldap-cert.pem -subject
subject= /C=US/ST=California/O=FooBar/CN=s014.cgi.foobar.com/CN=ldap1.cgi.foobar.com/CN=s14.cgi.foobar.com
The LDAP server FQHN is s014.cgi.foobar.com and has aliases of ldap1.cgi.foobar.com and s14.cgi.foobar.com. All hostname resolution is done with our internal DNS servers and they all have the correct FQHN and aliases.
On my secondary mirror LDAP server I have syncrepl setup to use the hostname alias ldap1.cgi.foobar.com syncrepl ... provider=ldap://ldap1.cgi.foobar.com starttls=critical ... and that works fine.
When I have my ldap.conf with: URI ldap://s014.cgi.foobar.com the command "ldapsearch -x -ZZ" works just fine.
When I change my ldap.conf to: URI ldap://ldap1.cgi.foobar.com the command "ldapsearch -x -ZZ" returns ldap_start_tls: Connect error (-11) additional info: TLS: hostname does not match CN in peer certificate.
It seems the openldap library is only checking the first CN in the certificate and not all the others. Is there any way to have it check the other CN entries in the cert?