Hi,<div><br></div><div>I setup openldap-2.4.23 server on centos6.2 using cn=config. The server itself doesn&#39;t authenticate through ldap. Network clients are able to authenticate but the network traffic is unencrypted.</div>
<div><br></div><div>Next step is to configure SSL/TLS. I was reading multiple sources of documentation, trying to understand what I&#39;m doing not just follow instructions. I created a CA, generated certificate for the server and setup these in cn=config:</div>
<div><br></div><div><div>olcTLSCACertificateFile: /etc/openldap/cacerts/CA.crt</div><div>olcTLSCertificateFile: /etc/pki/tls/certs/ldapserver.crt</div><div>olcTLSCertificateKeyFile: /etc/pki/tls/private/ldapserver-nopass.key</div>
<div>olcTLSVerifyClient: demand</div></div><div><br></div><div>I was expecting that after slapd restart clients will not being able to authenticate but they still can and the traffic is still unencrypted. On the server if I run tcpdump I can clearly see usernames and passwords.</div>
<div><br></div><div>Service slapd is running as user ldap and I made sure the user has read access to all cert files and private keys. I enabled logging level &quot;olcLogLevel: stats&quot; but I don&#39;t see any errors in the log file.</div>
<div><br></div><div>Shouldn&#39;t &quot;olcTLSVerifyClient: demand&quot; drop the connection if the client doesn&#39;t provide valid certificate?</div><div><br></div><div>Thank you for any pointers.</div><div><br></div><div>
--</div><div>Peter</div>