Hi Everyone,
I'm trying to set-up an new openldap service utilising TLS. At the
moment, it all appears to work fine with out TLS, but unfortunately it
always fails with it.
The service is running on neptune.mps.lan (with a CNAME for ldap), and
my client desktop box is called blacktip. The server is Ubuntu 10.04 LTS
server, and the desktop is also Ubuntu 10.04; both with latest updates.
I have created a Self signed CA and, after setting up the server keys, I
have installed this onto the client. I then added the following line to
the client /etc/ldap.conf:
TLS_CACERT /etc/ssl/certs/slapd-ca-cert.pem
This is the command I am running to test the connection:
root@blacktip:~# ldapsearch -d 16383 -x -h ldap.mps.lan -ZZ -b
dc=mps,dc=lan
ldap_create
ldap_url_parse_ext(ldap://ldap.mps.lan)
ldap_extended_operation_s
ldap_extended_operation
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP ldap.mps.lan:389
ldap_new_socket: 3
ldap_prepare_socket: 3
ldap_connect_to_host: Trying 10.0.0.203:389
ldap_pvt_connect: fd: 3 tm: -1 async: 0
ldap_open_defconn: successful
ldap_send_server_request
ber_scanf fmt ({it) ber:
ber_dump: buf=0x7f1965937630 ptr=0x7f1965937630 end=0x7f196593764f
len=31
0000: 30 1d 02 01 01 77 18 80 16 31 2e 33 2e 36 2e 31
0....w...1.3.6.1
0010: 2e 34 2e 31 2e 31 34 36 36 2e 32 30 30 33
37 .4.1.1466.20037
ber_scanf fmt ({) ber:
ber_dump: buf=0x7f1965937630 ptr=0x7f1965937635 end=0x7f196593764f
len=26
0000: 77 18 80 16 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e
w...1.3.6.1.4.1.
0010: 31 34 36 36 2e 32 30 30 33 37
1466.20037
ber_flush2: 31 bytes to sd 3
0000: 30 1d 02 01 01 77 18 80 16 31 2e 33 2e 36 2e 31
0....w...1.3.6.1
0010: 2e 34 2e 31 2e 31 34 36 36 2e 32 30 30 33
37 .4.1.1466.20037
ldap_write: want=31, written=31
0000: 30 1d 02 01 01 77 18 80 16 31 2e 33 2e 36 2e 31
0....w...1.3.6.1
0010: 2e 34 2e 31 2e 31 34 36 36 2e 32 30 30 33
37 .4.1.1466.20037
ldap_result ld 0x7f196592f3a0 msgid 1
wait4msg ld 0x7f196592f3a0 msgid 1 (infinite timeout)
wait4msg continue ld 0x7f196592f3a0 msgid 1 all 1
** ld 0x7f196592f3a0 Connections:
* host: ldap.mps.lan port: 389 (default)
refcnt: 2 status: Connected
last used: Mon Aug 2 16:48:35 2010
** ld 0x7f196592f3a0 Outstanding Requests:
* msgid 1, origid 1, status InProgress
outstanding referrals 0, parent count 0
ld 0x7f196592f3a0 request count 1 (abandoned 0)
** ld 0x7f196592f3a0 Response Queue:
Empty
ld 0x7f196592f3a0 response count 0
ldap_chkResponseList ld 0x7f196592f3a0 msgid 1 all 1
ldap_chkResponseList returns ld 0x7f196592f3a0 NULL
ldap_int_select
read1msg: ld 0x7f196592f3a0 msgid 1 all 1
ber_get_next
ldap_read: want=8, got=8
0000: 30 0c 02 01 01 78 07 0a
0....x..
ldap_read: want=6, got=6
0000: 01 00 04 00 04
00 ......
ber_get_next: tag 0x30 len 12 contents:
ber_dump: buf=0x7f1965938e50 ptr=0x7f1965938e50 end=0x7f1965938e5c
len=12
0000: 02 01 01 78 07 0a 01 00 04 00 04
00 ...x........
read1msg: ld 0x7f196592f3a0 msgid 1 message type extended-result
ber_scanf fmt ({eAA) ber:
ber_dump: buf=0x7f1965938e50 ptr=0x7f1965938e53 end=0x7f1965938e5c len=9
0000: 78 07 0a 01 00 04 00 04 00
x........
read1msg: ld 0x7f196592f3a0 0 new referrals
read1msg: mark request completed, ld 0x7f196592f3a0 msgid 1
request done: ld 0x7f196592f3a0 msgid 1
res_errno: 0, res_error: <>, res_matched: <>
ldap_free_request (origid 1, msgid 1)
ldap_parse_extended_result
ber_scanf fmt ({eAA) ber:
ber_dump: buf=0x7f1965938e50 ptr=0x7f1965938e53 end=0x7f1965938e5c len=9
0000: 78 07 0a 01 00 04 00 04 00
x........
ldap_parse_result
ber_scanf fmt ({iAA) ber:
ber_dump: buf=0x7f1965938e50 ptr=0x7f1965938e53 end=0x7f1965938e5c len=9
0000: 78 07 0a 01 00 04 00 04 00
x........
ber_scanf fmt (}) ber:
ber_dump: buf=0x7f1965938e50 ptr=0x7f1965938e5c end=0x7f1965938e5c len=0
ldap_msgfree
tls_write: want=93, written=93
0000: 16 03 02 00 58 01 00 00 54 03 02 4c 56 e8 d3
01 ....X...T..LV...
0010: 2e bb 5d b7 71 7e ec ab 4c e0 6a 32 63 85 76
88 ..].q~..L.j2c.v.
0020: b9 12 b3 fc e3 56 fe 2a db 9a 0d 00 00 24 00
33 .....V.*.....$.3
0030: 00 45 00 39 00 88 00 16 00 32 00 44 00 38 00
87 .E.9.....2.D.8..
0040: 00 13 00 66 00 2f 00 41 00 35 00 84 00 0a 00
05 ...f./.A.5......
0050: 00 04 01 00 00 07 00 09 00 03 02 00
01 .............
tls_read: want=5, got=0
TLS: can't connect: A TLS packet with unexpected length was received..
ldap_err2string
ldap_start_tls: Connect error (-11)
additional info: A TLS packet with unexpected length was received.
As you can see, the TLS connection fails to negotiate. I have
extensively googled this error but have not yet found a cause nor a
solution.
OpenLDAP server version:
root@neptune:~# slapd -V
@(#) $OpenLDAP: slapd 2.4.21 (Apr 26 2010 11:08:43) $
buildd@yellow:/build/buildd/openldap-2.4.21/debian/build/servers/slapd
Gnutls Library Version:
root@neptune:~# aptitude show libgnutls26 | grep ^Ver
Version: 2.8.5-2
Many thanks in advance for any help/advice given.
Kind Regards,
Russell Knighton
--