I've run into an interesting issue where if I set up a .ldaprc for the user running slapd with:
BASE "" TLS_CACERT /opt/zimbra/conf/ca/ca.pem
slapd will fail to start with:
TLS: could not load client CA list (file:`/opt/zimbra/conf/ca/ca.pem',dir:`'). TLS: error:0906D06C:PEM routines:PEM_read_bio:no start line pem_lib.c:642
It is not an issue with being able to read the cert as:
cat /opt/zimbra/conf/ca/ca.pem -----BEGIN TRUSTED CERTIFICATE----- ..... -----END TRUSTED CERTIFICATE-----
works just fine. If I change it to TLSCACERTDIR and adjust to a path, then slapd starts just fine, but I can't negotiate STARTTLS for the same reason.
Using openssl to verify the slapd cert (which is signed by this CA) shows everything is correct, as well:
/usr/bin/openssl verify -CAfile /opt/zimbra/conf/ca/ca.pem -purpose sslclient /opt/zimbra/conf/slapd.crt /opt/zimbra/conf/slapd.crt: OK
I'm not really sure why defining a CA cert for the client to use stops slapd from working, either. Seems rather odd to me.
Thoughts appreciated. ;)
--Quanah
--
Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration
Quanah Gibson-Mount writes:
TLS_CACERT /opt/zimbra/conf/ca/ca.pem (...) If I change it to TLS_CACERTDIR and adjust to a path, (...)
If I remember correctly TLS_CACERTDIR needs to be set up with some OpenSSL magic, it's not just a directory into which you can drop certificate files. Maybe the reverse is true as well, and a cert from a TLS_CACERTDIR does not work in TLS_CACERT.
Hallvard B Furuseth wrote:
Quanah Gibson-Mount writes:
TLS_CACERT /opt/zimbra/conf/ca/ca.pem (...) If I change it to TLS_CACERTDIR and adjust to a path, (...)
If I remember correctly TLS_CACERTDIR needs to be set up with some OpenSSL magic, it's not just a directory into which you can drop certificate files. Maybe the reverse is true as well, and a cert from a TLS_CACERTDIR does not work in TLS_CACERT.
cd <TLS_CACERTDIR> ln -s <CAcertfile> `openssl x509 -hash -noout -in <CAcertfile>`.0
--On Thursday, August 16, 2007 2:42 PM +0200 Hallvard B Furuseth h.b.furuseth@usit.uio.no wrote:
Quanah Gibson-Mount writes:
TLS_CACERT /opt/zimbra/conf/ca/ca.pem (...) If I change it to TLS_CACERTDIR and adjust to a path, (...)
If I remember correctly TLS_CACERTDIR needs to be set up with some OpenSSL magic, it's not just a directory into which you can drop certificate files. Maybe the reverse is true as well, and a cert from a TLS_CACERTDIR does not work in TLS_CACERT.
Thank you both for your responses. Interestingly enough, slapd will start, and STARTTLS will work, if I create the hash and use TLSCACERTDIR.
However, why won't it work if I use TLS_CACERT <file> ? It should be perfectly valid, and that actually works for me on every other platform I use (Linux). The only one where this doesn't work is on MAC OS X. Must be a Mac specific bug I guess.
--Quanah
--
Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration
Failure on just CAcert could be ownership/permission problems (file vs app). If there is more than one CA in the "certificate chain", then a single CAcert might not succeed. If OS X has "ktrace" (or equivalent), it might help to identify what is being looked for when single CAcert directive is used.
Quanah Gibson-Mount wrote:
--On Thursday, August 16, 2007 2:42 PM +0200 Hallvard B Furuseth h.b.furuseth@usit.uio.no wrote:
Quanah Gibson-Mount writes:
TLS_CACERT /opt/zimbra/conf/ca/ca.pem (...) If I change it to TLS_CACERTDIR and adjust to a path, (...)
If I remember correctly TLS_CACERTDIR needs to be set up with some OpenSSL magic, it's not just a directory into which you can drop certificate files. Maybe the reverse is true as well, and a cert from a TLS_CACERTDIR does not work in TLS_CACERT.
Thank you both for your responses. Interestingly enough, slapd will start, and STARTTLS will work, if I create the hash and use TLSCACERTDIR.
However, why won't it work if I use TLS_CACERT <file> ? It should be perfectly valid, and that actually works for me on every other platform I use (Linux). The only one where this doesn't work is on MAC OS X. Must be a Mac specific bug I guess.
--On Thursday, August 16, 2007 8:29 PM -0500 User1001 supraexpress@globaleyes.net wrote:
Failure on just CAcert could be ownership/permission problems (file vs app). If there is more than one CA in the "certificate chain", then a single CAcert might not succeed. If OS X has "ktrace" (or equivalent), it might help to identify what is being looked for when single CAcert directive is used.
If you read my note, you'll see that I already showed that file permissions were not an issue. In any case, setting up roots .ldaprc had the same result in starting slapd -- it wouldn't start. And there is only the single ca.pem file in that directory, so it isn't a case of multiple CA certs, either.
--Quanah
--
Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration
openldap-software@openldap.org
-
Hallvard B Furuseth -
Quanah Gibson-Mount -
User1001