From: Rich Megginson [mailto:rich.megginson@gmail.com]

See http://www.openldap.org/faq/data/cache/1514.html
Using Builtin Root Certs:

-

Hi Rich,

 

Thanks for responding. 

 

I read that.   So, I did ln -s /usr/lib64/libnssckbi.so to my nss key directory… doesn’t seem to have any effect.  If I do certutil -d /etc/openldap/nssdb/ -L -h all then it shows all of those certs as expected, including:

Builtin Object Token:GeoTrust Global CA                      C,C,C

Builtin Object Token:GeoTrust Global CA 2                    C,C,C

Builtin Object Token:GeoTrust Universal CA                   C,C,C

Builtin Object Token:GeoTrust Universal CA 2                 C,C,C

Builtin Object Token:GeoTrust Primary Certification Authority C,, 

Builtin Object Token:GeoTrust Primary Certification Authority - G3 C,C,C

Builtin Object Token:GeoTrust Primary Certification Authority - G2 C,C,C

 

For Geotrust.  It still shows the geotrust-intermediate cert that I imported:

geotrust-intermediate                                        ,,  

 

as well.  But with or without an explicit “olcTLSCACertificateFile: geotrust-intermediate”, ldapwhomi -d1 produces:

ldap_url_parse_ext(ldaps://ds.clarku.edu)

ldap_create

ldap_url_parse_ext(ldaps://ds.clarku.edu:636/??base)

ldap_sasl_bind

ldap_send_initial_request

ldap_new_connection 1 1 0

ldap_int_open_connection

ldap_connect_to_host: TCP ds.clarku.edu:636

ldap_new_socket: 3

ldap_prepare_socket: 3

ldap_connect_to_host: Trying 140.232.1.12:636

ldap_pvt_connect: fd: 3 tm: -1 async: 0

TLS: peer cert untrusted or revoked (0x42)

TLS: can't connect: (unknown error code).

ldap_err2string

ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)

 

What am I missing?