I am currently in the grips of trying to get syncrepl replication
working with StartTLS. It was working fine until recently. The only
change that occurred over the last 12 months (that relates to OpenLDAP)
is that I've started requiring TLS for connections.
My provider is running OpenLDAP 2.4.31 on Ubuntu 14.04, while one
consumer is running the exact same version on a Ubuntu 14.04 machine and
the other consumer is running OpenLDAP 2.4.28 on Ubuntu 12.04.
The provider has, AFAIK, a correct TLS configuration, given that I can connect and search using the ldapsearch -ZZ
utility from any of the servers.
Unfortunately, on both consumers can't seem to be able to actually start the TLS connection:
slapd: slap_client_connect: URI=ldap://[LDAP_DNS] Error, ldap_start_tls failed (-11)
slapd: do_syncrepl: rid=001 rc -11 retrying
And the provider shows the following errors:
slapd: conn=1586 fd=100 ACCEPT from IP=[CONSUMER_IP]:35500 (IP=0.0.0.0:389)
slapd: conn=1586 op=0 EXT oid=184.108.40.206.4.1.1466.20037
slapd: conn=1586 op=0 STARTTLS
slapd: conn=1586 op=0 RESULT oid= err=0 text=
slapd: conn=1586 fd=100 closed (TLS negotiation failure)
Is there anything that I'm missing?