8:20 a.m.
Hi list!
I've an installation of OpenLDAP 2.3-19, I've a problem using TLS/SSL
support:
My master server seem to be work fine, but when I try to use the command "
ldapsearch -x -H ldaps://master.mydomain 'filter' " , I get the following
error:
ldap_bind: Can't contact LDAP server (-1)
additional info: error:14094413:SSL
routines:SSL3_READ_BYTES:sslv3 alert unsupported certificate
My slapd.conf configuration:
#
TLSCipherSuite HIGH:MEDIUM:+SSLv2:RSA
TLSCertificateFile /etc/openldap/cacerts/master.pem
TLSCertificateKeyFile /etc/openldap/cacerts/master- key.pem
TLSCACertificateFile /etc/openldap/cacerts/cacert.pem
TLSVerifyClient demand
#
My ldap.conf configuration:
#
Base=mydomain
SIZELIMIT 0
TIMELIMIT 0
TLS_CACERT /etc/openldap/cacerts/cacert.pem
TLS_CERT /etc/openldap/cacerts/master.pem
TLS_KEY /etc/openldap/cacerts/master-key.pem
TLS_REQCERT demand
#
My .ldaprc configuration:
#
TLS_CACERT /etc/openldap/cacerts/cacert.pem
TLS_CERT /etc/openldap/cacerts/master.pem
TLS_KEY /etc/openldap/cacerts/master-key.pem
TLS_REQCERT demand
#
Error:
TLS trace: SSL3 alert read:fatal:unsupported certificate
TLS trace: SSL_connect:failed in SSLv3 read finished A
TLS: can't connect.
ldap_perror
ldap_bind: Can't contact LDAP server (-1)
additional info: error:14094413:SSL
routines:SSL3_READ_BYTES:sslv3 alert unsupported certificate
What does mean that? Which ones are supported certificates?
I'm using the same certificate to my server and my client
I googling and found that the error probably means:
"This catch-all error message can mean a variety of things which all have to
do with an invalid certificate for this connection. It is most frequently
triggered when the CN of the certificate doesn't match the hostname of the
entity communicating. It can also be a signal that your certificate is
beyond its validity period"
But my CN and validity period are ok.
My cert is an x509v3 certificate and when I "read" it with openssl I
get:
So I can read it ok
============
openssl x509 -in master.pem.crt -text -noout
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
30:30:30:30:30:30:30:30:30:30:30:30:30:30:30:30:31:33:32:36
Signature Algorithm: sha1WithRSAEncryption
Issuer: L=My location, ST=My state, C=My
Country/postalCode=232312/streetAddress=My address, CN=Institute , OU=Unit,
O=Institute /emailAddress= ca@mydomain
Validity
Not Before: Apr 4 00:00:00 2007 GMT
Not After : Apr 3 00:00:00 2008 GMT
Subject: L=My location, ST=My statte, C=My country, CN=
master.mydomain, OU=Unit, O=Institute /emailAddress= ca(a)mydomain.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public Key: (1024 bit)
Modulus (1024 bit):
00:c4:53:a7:53:60:2c:57:9b:b9:2a:c8:fa:f3:8e:
55:fb:a3:43:5e:9b:10:6a:2a:14:ac:0a:e3:18:2d:
86:51:5f:6e:da:da:12:39:de:96:e2:fc:39:bc:ba:
b0:ff:10:68:91:88:d6:52:90:f3:c6:09:29:d1:24:
18:6c:e5:ea:82:ba:0b:f5:27:04:cd:19:df:9c:2e:
25:25:62:5c:d0:71:c8:0b:d4:aa:9c:55:b5:c7:72:
9c:83:fc:95:2a:69:e3:35:6e:85:19:db:3c:52:b0:
98:bd:48:ad:ba:b6:cb:d2:96:f4:7d:3c:43:4b:76:
45:f0:4b:64:1a:41:29:63:5f
Exponent: 65537 (0x10001)
X509v3 extensions:
Authority Information Access:
OCSP - URI: http://1X.X:X:X:8082
X509v3 CRL Distribution Points:
URI:http://url:getcrl
X509v3 Extended Key Usage:
TLS Web Server Authentication
X509v3 Key Usage:
Digital Signature, Non Repudiation, Key Encipherment, Key
Agreement
Netscape Cert Type:
SSL Server
Signature Algorithm: sha1WithRSAEncryption
2f:81:c3:38:3b:5b:2b:df:dd:52:10:1f:7e:fa:65:03:03:96:
a3:07:9d:6b:ec:7d:7f:05:31:4d:55:81:9c:06:28:e2:21:df:
b9:ae:1f:62:e0:01:d0:46:74:01:43:50:43:00:62:40:28:f9:
be:b6:b2:14:25:00:b7:71:76:3c:20:54:30:8a:94:5b:29:52:
af:50:ef:21:db:c7:54:6c:cd:d2:58:bc:4f:26:98:fa:b8:0d:
b5:d1:1f:62:18:df:e2:02:3d:70:f1:a7:90:5a:40:74:f7:5f:
c2:8f:5d:96:73:5f:4c:b4:1f:3f:b7:49:1c:7a:65:a7:90:c8:
7a:d0:dd:04:45:0b:65:31:a7:b7:18:f8:24:a2:4c:b5:2b:3d:
3e:cd:e3:f3:69:27:40:71:bb:a7:73:d9:99:c5:fa:73:d4:98:
d3:46:2a:2e:d1:9a:45:50:36:f7:bb:f0:f9:86:95:52:d5:7d:
cc:a7:a9:74:6c:e7:ef:56:a7:b3:f8:d7:e5:c8:81:ee:2d:3e:
01:20:e7:bb:e6:3e:20:66:55:a6:12:9d:8c:51:0b:93:d4:58:
86:57:ee:72:db:8a:f5:85:f2:73:b3:ad:6c:9d:e7:b1:3a:36:
0f:99:09:5f:31:ef:4c:3c:4d:e1:f2:ba:99:74:3e:78:be:97:
de:4b:0b:0f
================
When i try ldapsearch in debug mode:
# ldapsearch -x -H ldaps://master.mydomain "uid=user" -d1
ldap_create
ldap_url_parse_ext(ldaps://master.mydomain)
ldap_bind
ldap_simple_bind
ldap_sasl_bind
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP master.mydomain:636
ldap_new_socket: 3
ldap_prepare_socket: 3
ldap_connect_to_host: Trying 10.X.X.X:636
ldap_connect_timeout: fd: 3 tm: -1 async: 0
TLS trace: SSL_connect:before/connect initialization
TLS trace: SSL_connect:SSLv2/v3 write client hello A
TLS trace: SSL_connect:SSLv3 read server hello A
TLS certificate verification: depth: 1, err: 0, subject: /bla bla bla ....
TLS certificate verification: depth: 0, err: 0, subject: /bla bla bla ...
TLS trace: SSL_connect:SSLv3 read server certificate A
TLS trace: SSL_connect:SSLv3 read server certificate request A
TLS trace: SSL_connect:SSLv3 read server done A
TLS trace: SSL_connect:SSLv3 write client certificate A
TLS trace: SSL_connect:SSLv3 write client key exchange A
TLS trace: SSL_connect:SSLv3 write certificate verify A
TLS trace: SSL_connect:SSLv3 write change cipher spec A
TLS trace: SSL_connect:SSLv3 write finished A
TLS trace: SSL_connect:SSLv3 flush data
TLS trace: SSL3 alert read:fatal:unsupported certificate
TLS trace: SSL_connect:failed in SSLv3 read finished A
TLS: can't connect.
ldap_perror
ldap_bind: Can't contact LDAP server (-1)
additional info: error:14094413:SSL
routines:SSL3_READ_BYTES:sslv3 alert unsupported certificate
Thanks for your responses.
--
@ntonio
8:28 a.m.
On Tue, Apr 10, 2007 at 10:20:16AM -0500, Antonio Camacho wrote:
Hi list!
I've an installation of OpenLDAP 2.3-19, I've a problem using TLS/SSL
support:
My master server seem to be work fine, but when I try to use the command "
ldapsearch -x -H ldaps://master.mydomain 'filter' " , I get the following
^^^^^^^^^^^^^^^^^
-Z
?
WBR.
Dmitriy
8:36 p.m.
Antonio Camacho wrote, on 10. apr 2007 17:20:
[...]
My slapd.conf configuration:
#
TLSCipherSuite HIGH:MEDIUM:+SSLv2:RSA
TLSCertificateFile /etc/openldap/cacerts/master.pem
TLSCertificateKeyFile /etc/openldap/cacerts/master- key.pem
TLSCACertificateFile /etc/openldap/cacerts/cacert.pem
Don't use this:
TLSVerifyClient demand
#
My ldap.conf configuration:
#
Base=mydomain
SIZELIMIT 0
TIMELIMIT 0
TLS_CACERT /etc/openldap/cacerts/cacert.pem
Don't use these:
TLS_CERT /etc/openldap/cacerts/master.pem
TLS_KEY /etc/openldap/cacerts/master-key.pem
TLS_REQCERT demand
My .ldaprc configuration:
~/.ldaprc is redundant; scrap it.
> #
> TLS_CACERT /etc/openldap/cacerts/cacert.pem
TLS_CERT /etc/openldap/cacerts/master.pem
TLS_KEY /etc/openldap/cacerts/master-key.pem
TLS_REQCERT demand
For the rest things look ok.
--Tonni
--
Tony Earnshaw
Email: tonni at hetnet dot nl
8:38 p.m.
Dmitriy Kirhlarov wrote, on 10. apr 2007 17:28:
> I've an installation of OpenLDAP 2.3-19, I've a problem
using TLS/SSL
> support:
>
> My master server seem to be work fine, but when I try to use the command "
> ldapsearch -x -H ldaps://master.mydomain 'filter' " , I get the
following
^^^^^^^^^^^^^^^^^
-Z
?
Nope; can't use -Z with ldaps.
--Tonni
--
Tony Earnshaw
Email: tonni at hetnet dot nl
11:11 p.m.
Tony Earnshaw wrote:
Antonio Camacho wrote, on 10. apr 2007 17:20:
[...]
> My slapd.conf configuration:
> #
> TLSCipherSuite HIGH:MEDIUM:+SSLv2:RSA
> TLSCertificateFile /etc/openldap/cacerts/master.pem
> TLSCertificateKeyFile /etc/openldap/cacerts/master- key.pem
> TLSCACertificateFile /etc/openldap/cacerts/cacert.pem
Don't use this:
> TLSVerifyClient demand
> #
If he's trying to use certificate-based authentication, then he needs
that statement.
> My ldap.conf configuration:
> #
> Base=mydomain
> SIZELIMIT 0
> TIMELIMIT 0
>
> TLS_CACERT /etc/openldap/cacerts/cacert.pem
Don't use these:
> TLS_CERT /etc/openldap/cacerts/master.pem
> TLS_KEY /etc/openldap/cacerts/master-key.pem
Those two are ignored in ldap.conf anyway.
> TLS_REQCERT demand
This is the default for a client, and in most cases it ought to remain
with that setting.
> My .ldaprc configuration:
~/.ldaprc is redundant; scrap it.
No. If he is trying to use certificate-based authentication, then the
TLS_CERT and TLS_KEY directives belong in the ~/.ldaprc.
Since he didn't actually state whether he is trying to use cert-based
authentication or not, and nobody has actually asked that question yet,
you're offering advice without any factual basis for your suggestions.
Find out what the real problem is before offering advice. Find out what
the real goal is first.
From the information provided so far, all that's certain is that he has
a TLS certificate that is intended for use as a web server
authentication certificate. The fact that he's trying to use it in both
the server and the client configuration is the problem; the TLS library
checks the certificate purpose. The client sent a server cert to the
server, and the server won't allow it to be used for client authentication.
So, if the goal is to use certificate-based authentication, then the
solution is to generate a proper certificate without any usage
restrictions on it, or one that says it can be used for client
authentication.
If the goal isn't to use certificate-based authentication, then some of
your advice is correct. But you don't know enough at this point to say
for certain. Ask for clarification before offering advice.
--
-- Howard Chu
Chief Architect, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc/
Chief Architect, OpenLDAP http://www.openldap.org/project/
1:41 a.m.
Howard Chu wrote, on 11. apr 2007 08:11:
[...]
So, if the goal is to use certificate-based authentication, then the
solution is to generate a proper certificate without any usage
restrictions on it, or one that says it can be used for client
authentication.
If the goal isn't to use certificate-based authentication, then some of
your advice is correct.
It seemed to me that OP was simply trying to establish an encrypted
connection, as so many have done in the past and slapd was barfing on a
missing client cert.
But you don't know enough at this point to say
for certain. Ask for clarification before offering advice.
Indeed. I'll remember that :)
--Tonni
--
Tony Earnshaw
Email: tonni at hetnet dot nl
6:35 a.m.
Tony Earnshaw wrote:
Howard Chu wrote, on 11. apr 2007 08:11:
[...]
> So, if the goal is to use certificate-based authentication, then the
> solution is to generate a proper certificate without any usage
> restrictions on it, or one that says it can be used for client
> authentication.
>
> If the goal isn't to use certificate-based authentication, then some of
> your advice is correct.
It seemed to me that OP was simply trying to establish an encrypted
connection, as so many have done in the past and slapd was barfing on a
missing client cert.
The error message pretty clearly says the certificate is unsupported.
That's quite different from saying the certificate is missing. Ignoring
the error message will generally lead you down a lot of dead ends...
--
-- Howard Chu
Chief Architect, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc/
Chief Architect, OpenLDAP http://www.openldap.org/project/
6083
days inactive
6084
days old
openldap-software@openldap.org
6 comments
4 participants
participants (4)
-
Antonio Camacho -
Dmitriy Kirhlarov -
Howard Chu -
Tony Earnshaw