Hi!

After „playing“ significant time with certificate authentication, I managed to authenticate one user. However when I tried to authenticate a different user with a similar certificate, I see a

TLS trace: SSL3 alert read:fatal:unsupported certificate

Error. Can I can some details about the “usupportedness” of my certificate? The only thing I could think if is that uid of the newer certificate has a CN that is three characters longer than the one that worked.

A more complete trace for ldapwhoami woul look like this:

…

ldap_parse_result

ber_scanf fmt ({iAA) ber:

ber_scanf fmt (}) ber:

ldap_msgfree

TLS trace: SSL_connect:before SSL initialization

TLS trace: SSL_connect:SSLv3/TLS write client hello

TLS trace: SSL_connect:SSLv3/TLS write client hello

TLS trace: SSL_connect:SSLv3/TLS read server hello

TLS trace: SSL_connect:TLSv1.3 read encrypted extensions

TLS trace: SSL_connect:SSLv3/TLS read server certificate request

TLS certificate verification: depth: 2, err: 0, subject: /…. Root-CA (2018), issuer: /… Root-CA (2018)

TLS certificate verification: depth: 1, err: 0, subject: /… Host-CA (2018), issuer: /… Root-CA (2018)

TLS certificate verification: depth: 0, err: 0, subject: /… FQHN, issuer: /… Host-CA (2018)

TLS trace: SSL_connect:SSLv3/TLS read server certificate

TLS trace: SSL_connect:TLSv1.3 read server certificate verify

TLS trace: SSL_connect:SSLv3/TLS read finished

TLS trace: SSL_connect:SSLv3/TLS write change cipher spec

TLS trace: SSL_connect:SSLv3/TLS write client certificate

TLS trace: SSL_connect:SSLv3/TLS write certificate verify

TLS trace: SSL_connect:SSLv3/TLS write finished

ldap_sasl_interactive_bind: user selected: EXTERNAL

ldap_int_sasl_bind: EXTERNAL

ldap_int_sasl_open: host=FQHN

SASL/EXTERNAL authentication started

ldap_sasl_bind

ldap_send_initial_request

ldap_send_server_request

ber_scanf fmt ({it) ber:

ber_scanf fmt ({i) ber:

ber_flush2: 26 bytes to sd 3

ldap_msgfree

ldap_result ld 0x56432476ac30 msgid 2

wait4msg ld 0x56432476ac30 msgid 2 (infinite timeout)

wait4msg continue ld 0x56432476ac30 msgid 2 all 1

** ld 0x56432476ac30 Connections:

* host: FQHN  port: 389  (default)

* from: IP=172.20.16.36:57868

  refcnt: 2  status: Connected

  last used: Wed Mar  5 15:42:03 2025

** ld 0x56432476ac30 Outstanding Requests:

* msgid 2,  origid 2, status InProgress

   outstanding referrals 0, parent count 0

  ld 0x56432476ac30 request count 1 (abandoned 0)

** ld 0x56432476ac30 Response Queue:

   Empty

  ld 0x56432476ac30 response count 0

ldap_chkResponseList ld 0x56432476ac30 msgid 2 all 1

ldap_chkResponseList returns ld 0x56432476ac30 NULL

ldap_int_select

read1msg: ld 0x56432476ac30 msgid 2 all 1

ber_get_next

TLS trace: SSL3 alert read:fatal:unsupported certificate

ber_get_next failed, errno=0.

ldap_err2string

ldap_sasl_interactive_bind: Can't contact LDAP server (-1)

…

Kind regards,

Ulrich Windl