Working on moving from RHEL6 to RHEL8. Given the drop in support for openldap in RHEL8 I've installed the symas-openldap distros.

Here are the versions in play:

cat /etc/redhat-release

Red Hat Enterprise Linux release 8.2 (Ootpa)

sudo yum list installed | grep openldap

openldap.x86_64 2.4.46-9.el8 @rhel-8-for-x86_64-baseos-rpms

symas-openldap.x86_64 2.4.55-1.el8 @sofl

symas-openldap-clients.x86_64 2.4.55-1.el8 @sofl

symas-openldap-servers.x86_64 2.4.55-1.el8 @sofl

$ openssl version

OpenSSL 1.1.1c FIPS 28 May 2019

I can't get any TLS connections to succeed, even if I try ldapsearch from the local (ldap server) host. The net error is cipher incompatibility; here's the output from a local ldapsearch:

ldap_url_parse_ext(ldaps://dev-pnldap1.net.isc.upenn.edu:636)

ldap_create

ldap_url_parse_ext(ldaps://dev-pnldap1.net.isc.upenn.edu:636/??base)

ldap_sasl_bind

ldap_send_initial_request

ldap_new_connection 1 1 0

ldap_int_open_connection

ldap_connect_to_host: TCP dev-pnldap1.net.isc.upenn.edu:636

ldap_new_socket: 3

ldap_prepare_socket: 3

ldap_connect_to_host: Trying 130.91.185.254:636

ldap_pvt_connect: fd: 3 tm: -1 async: 0

attempting to connect:

connect success

TLS trace: SSL_connect:before SSL initialization

TLS trace: SSL_connect:SSLv3/TLS write client hello

TLS trace: SSL3 alert read:fatal:handshake failure

TLS trace: SSL_connect:error in error

TLS: can't connect: error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure.

ldap_err2string

ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)

I had slapd running in foreground for that ldapsearch, here's the output:

TLS trace: SSL_accept:before SSL initialization

tls_read: want=5, got=5

0000: 16 03 01 01 26 ....&

tls_read: want=294, got=294

0000: 01 00 01 22 03 03 cb 02 a0 2f ea 25 ad d7 c9 8e ..."...../.%....

0010: f0 32 a4 1e a9 46 be af 48 9e e6 23 53 44 d2 f7 .2...F..H..#SD..

0020: e0 9d 99 82 50 17 20 dd fa 96 00 76 ab ce a7 ec ....P. ....v....

0030: 2b b9 e6 51 e0 77 78 2d ca 73 4c f4 eb 62 ed 62 +..Q.wx-.sL..b.b

0040: 97 3b d4 ea ea 16 ab 00 48 13 02 13 03 13 01 13 .;......H.......

0050: 04 c0 2c c0 30 cc a9 cc a8 c0 ad c0 2b c0 2f c0 ..,.0.......+./.

0060: ac c0 23 c0 27 c0 0a c0 14 c0 09 c0 13 00 9d c0 ..#.'...........

0070: 9d 00 9c c0 9c 00 3d 00 3c 00 35 00 2f 00 9f cc ......=.<.5./...

0080: aa c0 9f 00 9e c0 9e 00 6b 00 67 00 39 00 33 00 ........k.g.9.3.

0090: ff 01 00 00 91 00 0b 00 04 03 00 01 02 00 0a 00 ................

00a0: 0c 00 0a 00 1d 00 17 00 1e 00 19 00 18 00 23 00 ..............#.

00b0: 00 00 16 00 00 00 17 00 00 00 0d 00 30 00 2e 04 ............0...

00c0: 03 05 03 06 03 08 07 08 08 08 09 08 0a 08 0b 08 ................

00d0: 04 08 05 08 06 04 01 05 01 06 01 03 03 02 03 03 ................

00e0: 01 02 01 03 02 02 02 04 02 05 02 06 02 00 2b 00 ..............+.

00f0: 05 04 03 04 03 03 00 2d 00 02 01 01 00 33 00 26 .......-.....3.&

0100: 00 24 00 1d 00 20 8a 31 32 cf fd 40 46 5d aa b6 .$... .12..@F]..

0110: 4b 31 fb a2 6d 47 92 f9 46 25 02 ce 62 7a cf 0b K1..mG..F%..bz..

0120: 93 38 00 37 7f 2f .8.7./

TLS trace: SSL_accept:before SSL initialization

tls_write: want=7, written=7

0000: 15 03 03 00 02 02 28 ......(

TLS trace: SSL3 alert write:fatal:handshake failure

TLS trace: SSL_accept:error in error

TLS: can't accept: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher.

5fa072c7 connection_read(11): TLS accept failure error=-1 id=1000, closing

I've tried various combinations of TLSProtocolMin (3.3, 3.2, and not specifying at all) and the result is the same.

I tried specifiying the ciphers currently supported by openssl in TLSCipherSuite, same erros.

Running some outside utilities give the same information.

nmap: no ciphers returned for the rhel8 system:

nmap --script ssl-enum-ciphers -p 636 dev-pnldap1.net.isc.upenn.edu -Pn

Starting Nmap 5.51 ( http://nmap.org ) at 2020-11-02 16:25 EST

Nmap scan report for dev-pnldap1.net.isc.upenn.edu (130.91.185.254)

Host is up (0.0014s latency).

636/tcp open ldapssl

Nmap done: 1 IP address (1 host up) scanned in 0.85 seconds

$ nmap --script ssl-enum-ciphers -p 636 dev-pnldap2.net.isc.upenn.edu -Pn

Starting Nmap 5.51 ( http://nmap.org ) at 2020-11-02 16:25 EST

Nmap scan report for dev-pnldap2.net.isc.upenn.edu (130.91.185.136)

Host is up (0.0019s latency).

636/tcp open ldapssl

| TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA

| TLS_DHE_RSA_WITH_AES_128_CBC_SHA

| TLS_DHE_RSA_WITH_AES_128_CBC_SHA256

| TLS_DHE_RSA_WITH_AES_256_CBC_SHA

| TLS_DHE_RSA_WITH_AES_256_CBC_SHA256

| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA

| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA

| TLS_RSA_WITH_3DES_EDE_CBC_SHA

| TLS_RSA_WITH_AES_128_CBC_SHA

| TLS_RSA_WITH_AES_128_CBC_SHA256

| TLS_RSA_WITH_AES_256_CBC_SHA

| TLS_RSA_WITH_AES_256_CBC_SHA256

| TLS_RSA_WITH_RC4_128_MD5

| TLS_RSA_WITH_RC4_128_SHA

| Compressors (1)

|_ uncompressed

Nmap done: 1 IP address (1 host up) scanned in 0.30 seconds

Thanks in advance for any suggestions or corrections.