secp256k1 (a Koblitz curve) won't be interoperable, try prime256v1 (an openssl alias for SEC P-256 or secp256r1).
But that doesn't explain the wrong attributeType error you're getting.
Is your slapd perhaps built with GnuTLS instead of OpenSSL ?
Geert
On Tue, Dec 10, 2024 at 15:43:12 +0100, jehan Procaccia wrote:
OK, then I try to add that attribute TLSecName to my config (OLC) , but it fails :
/# ldapmodify -Y EXTERNAL -H ldapi:/// -f ./olcTLSecName-ECC.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 ldapmodify: wrong attributeType at line 4, entry "cn=config"/
the ldif contains / /
# cat /root/ldifidLdapFm/olcTLSSecName-ECC.ldif dn: cn=config changetype: modify *add: olcTLSECName olcTLSECName: secp256k1*
value took from / / /# openssl ecparam -list_curves *secp256k1 : SECG curve over a 256 bit prime field* secp384r1 : NIST/SECG curve over a 384 bit prime field secp521r1 : NIST/SECG curve over a 521 bit prime field prime256v1: X9.62/SECG curve over a 256 bit prime field/
I tried also with your proposed value
X25519:P-256
, it fails the same way here is the content of my ECDSA signed certificate
/# openssl x509 -in ./cert.pem -text -noout Certificate: Data: Version: 3 (0x2) Serial Number: 89:f9:6a:e3:82:60:1c:91:c3:02:18:ab:a6:f7:ab:60 * Signature Algorithm: ecdsa-with-SHA256*/*
did I missed something ?
thanks .
On 10/12/2024 12:06, Geert Hendrickx wrote:
IIRC OpenLDAP doesn't specify any curve by default for ECDHE. You need to specify it explicitly to be able to use ECDHE (and thus ECDSA), eg:
TLSECName X25519:P-256
This is also needed to get ECDHE key exchange with RSA certificates, btw. So perhaps OpenLDAP should configure a curve (list) by default?
(OpenSSL < 1.0.2 supports only a single curve. Pick P-256 in that case.)
Geert