Hi Lei, <br><br>What is the command line you are using with ldapsearch?<br><br>You need to specify -Z to start TLS and use certs.<br>From man ldapsearch:<br>-Z Issue  StartTLS  (Transport  Layer  Security)  extended  operation.  If you use -ZZ, the command will require the operation to be successful.<br>
<br>Give it a try.<br><br><div class="gmail_quote">On Wed, Oct 21, 2009 at 4:28 AM, Hallvard B Furuseth <span dir="ltr">&lt;<a href="mailto:h.b.furuseth@usit.uio.no">h.b.furuseth@usit.uio.no</a>&gt;</span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div class="im"><a href="mailto:leilei175@gmail.com">leilei175@gmail.com</a> writes:<br>
&gt; On the client side,I have set the TLS_REQCERT as demand.<br>
&gt; The TLS_CACERTDIR is also set, but I didn&#39;t put any certificate in the<br>
&gt; directory.<br>
&gt;<br>
&gt; To my surprise, even though no certificate is provided,<br>
&gt; ldapsearch could still succeed returning the data.<br>
&gt;<br>
&gt; Is this a bug?<br>
<br>
</div>Maybe the root certificate is installed with OpenSSL&#39;s default certs.<br>
<br>
Those are used if and only if you specify TLS_CACERT - or TLS_CACERTDIR<br>
I presume, but I haven&#39;t tested that.  See:<br>
  <a href="http://www.openldap.org/its/?findid=5582" target="_blank">http://www.openldap.org/its/?findid=5582</a><br>
<br>
--<br>
<font color="#888888">Hallvard<br>
</font></blockquote></div><br><br clear="all"><br>-- <br>Tony<br>