Hi,
this drives my crazy for about two days:
I do have two virtual Red Hat El 5.4 servers in a test environment. One should be an openldap master, the second should be a openldap slave.
openssl-0.9.8e-12.el5_4.1, openldap-2.3.43-3.el5 (RH EL original rpms)
I followed some instructions to set up TLS: Set up a CA, generate/sign certificates and keys, install tham on the servers and configure openldap, restart.
My problem is: tls works on the master (which also is my CA for the test), but not on the slave.
I've "openssl verify"ed and "openssl x509 -text"ed the certs - everything seams o.k.
I've checked ip addresses, name resolving, locations, pathes, permissions, fileversions - anything I can think of.
I've regenerated the key and cert for the slave following an other documentation (at least with the same steps), but alway do get the same error:
from the ldap server debug:
TLS trace: SSL3 alert write:fatal:handshake failure TLS trace: SSL_accept:error in SSLv3 read client hello B TLS trace: SSL_accept:error in SSLv3 read client hello B TLS: can't accept. TLS: error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher s3_srvr.c:975 connection_read(13): TLS accept failure error=-1 id=0, closing
from the ldap client debug:
TLS trace: SSL3 alert read:fatal:handshake failure TLS trace: SSL_connect:error in SSLv2/v3 read server hello A TLS: can't connect. ldap_perror ldap_start_tls: Connect error (-11) additional info: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure
May be I missed a step or still skiped something ...
A thousand kowtows for any helping hint...!!
Best regards,
Götz