Emmanuel Seyman wrote:
Hello, all.
I'm using the LTB packages for OpenLDAP 2.5.20 and trying to configure ldaps access. To that end, I have obtained a certificate signed by Allianz Infrastructure CA V, a sub-CA of Allianz Root CA III.
https://rootca.allianz.com/en/rootca3.htm
I have put:
- the certificates of the two CA in /etc/openldap/certs/ldap-ca.crt
- the server certificate in /etc/openldap/certs/ldap.crt
- the private key in /etc/openldap/certs/ldap.key
All files are owned by the 'ldap' user and are readable.
Over in slapd.conf, I have configured TLSCACertificateFile, TLSCertificateFile and TLSCertificateKeyFile with the correct filenames and have restarted slapd.
An "openssl s_client -connect ..." gives a verify return code of 0 (ok) but an "ldapsearch -x ... -d 1" gives me the following error:
Now, it's true that Root CA III is self-signed but that's true of any root CA. Both Infra V and Root III are trusted by the system and show up when I run "trust list --filter=ca-anchors".
Am I doing something wrong?
You've configured the slapd server. You haven't configured the CA certs for the LDAP clients.