Howard,

I use OpenSuse 10.2 with libldap-2.3.so.0.2.15 and if I have an empty ~/.ldaprc file ldap_start_tls_s comes back with error -11 Connect error

ldap_int_select read1msg: ld 0x8054608 msgid 1 all 1 read1msg: ld 0x8054608 msgid 1 message type extended-result read1msg: ld 0x8054608 0 new referrals read1msg: mark request completed, ld 0x8054608 msgid 1 request done: ld 0x8054608 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_extended_result ldap_parse_result ldap_msgfree TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 0, err: 20, subject: /CN=w2k3.windows2003.home, issuer: /DC=home/DC=windows2003/CN=Windows2003CA TLS certificate verification: Error, unable to get local issuer certificate TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect. ldap_err2string Error while setting start_tls for ldap server: Connect error(-11) ldap_free_connection 1 1 ldap_send_unbind

When I add tls_reqcert allow to ~/.ldaprc I get

ldap_int_select read1msg: ld 0x8054608 msgid 1 all 1 read1msg: ld 0x8054608 msgid 1 message type extended-result read1msg: ld 0x8054608 0 new referrals read1msg: mark request completed, ld 0x8054608 msgid 1 request done: ld 0x8054608 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_extended_result ldap_parse_result ldap_msgfree TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 0, err: 20, subject: /CN=w2k3.windows2003.home, issuer: /DC=home/DC=windows2003/CN=Windows2003CA TLS certificate verification: Error, unable to get local issuer certificate TLS certificate verification: depth: 0, err: 27, subject: /CN=w2k3.windows2003.home, issuer: /DC=home/DC=windows2003/CN=Windows2003CA TLS certificate verification: Error, certificate not trusted TLS certificate verification: depth: 0, err: 21, subject: /CN=w2k3.windows2003.home, issuer: /DC=home/DC=windows2003/CN=Windows2003CA TLS certificate verification: Error, unable to verify the first certificate TLS trace: SSL_connect:SSLv3 read server certificate A TLS trace: SSL_connect:SSLv3 read server certificate request A TLS trace: SSL_connect:SSLv3 read server done A TLS trace: SSL_connect:SSLv3 write client certificate A TLS trace: SSL_connect:SSLv3 write client key exchange A TLS trace: SSL_connect:SSLv3 write change cipher spec A TLS trace: SSL_connect:SSLv3 write finished A TLS trace: SSL_connect:SSLv3 flush data TLS trace: SSL_connect:SSLv3 read finished A TLS trace: SSL3 alert write:warning:bad certificate TLS: unable to get peer certificate. Successfully set up TLS protected connection to ldap server w2k3.windows2003.home:389

So, this setting definitely does something !!

Regards Markus

----- Original Message ----- From: "Howard Chu" hyc@symas.com Newsgroups: gmane.network.openldap.general To: "Markus Moeller" huaraz@moeller.plus.com Cc: openldap-software@openldap.org Sent: Tuesday, June 19, 2007 12:33 AM Subject: Re: Question about ldap_init, ldap_initialize, start_tls,LDAP_OPT_X_TLS_ALLOW and TLS/SSL

Markus Moeller wrote:

...

But it is allowed to be set in ldap.conf,

That doesn't necessarily mean anything. Lots of things can be set in ldap.conf that don't mean anything at all, since the parser ignores any keywords it doesn't recognize.

What evidence do you have that this particular setting actually does anything? A quick scan of the source code proves that it actually does nothing.

...

so why can't or shouldn't I be able to set it in my client without the pain of checking all the different config files ldap.conf, .ldaprc, ldaprc ... I'd like to be able to control my client options without the use of config files.

Go ahead and do that then. But don't waste time with options that don't actually have any meaning.

...

Regards Markus

----- Original Message ----- From: "Howard Chu" hyc@symas.com To: "Markus Moeller" huaraz@moeller.plus.com Cc: openldap-software@openldap.org Sent: Tuesday, June 19, 2007 12:01 AM Subject: Re: Question about ldap_init, ldap_initialize, start_tls, LDAP_OPT_X_TLS_ALLOW and TLS/SSL

...

Markus Moeller wrote:

...

Does anybody have some sample code of how to use LDAP_OPT_X_TLS_ALLOW in a client program with ldap_start_tls_s ? Is it a bug if it doesn't work ?

The LDAP_OPT_X_TLS option is incompatible with ldap_start_tls. You cannot use both together. In general, the LDAP_OPT_X_TLS option is deprecated and should not be used at all.

-- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/