On 11/21/2010 07:36 PM, Howard Chu wrote:
Dieter Klünter wrote:
Fri, Nov 19, 2010 at 02:58:30PM -0200, Márcio Luciano Donada wrote:
Hi list, When using TLS, I have information that I'm using a self-signed certificate, as shown below:
# ldapsearch -x -d5 -b 'ou=Usuarios,dc=xx,dc=com,dc=br' -H ldaps://121.1.1.97/ '(objectclass=*)' ldap_url_parse_ext(ldaps://121.1.1.97/) ldap_create ldap_url_parse_ext(ldaps://121.1.1.97:636/??base) ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP 121.1.1.97:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 121.1.1.97:636 ldap_pvt_connect: fd: 3 tm: -1 async: 0 TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 0, err: 18, subject: /C=AU/ST=Some-State/O=Internet Widgits Pty Ltd/CN=ldap.xx.com.br, issuer: -State/O=Internet Widgits Pty Ltd/CN=ldap.xx.com.br TLS certificate verification: Error, self signed certificate TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed (self signed certificate). ldap_err2string ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)
OpenLDAP is quite picky about correct certificate chains.
No, the software will accept whatever you tell it to use, if you configure it appropriately.
Agreed. I had to put together a test setup to convince myself first, but now it makes sense to me. =)
You really should create a full certificate chain, that is, a ca, a server certificate and a server key.
But yes, the Project always recommends that you do the right thing.
One thing I was wondering here is if his ldap is only accessible from within one location (i.e. no subnets physically separated that need to authenticate against this ldap server), self signed would not be a bad idea.
Otherwise, there is always cacert.org. That said, using the later could make it a bit simpler (at the expense of having to renew cert more often) as the ca is available and easy to deploy to other machines.