Re: OpenLDAP self-signed certificates issue

On 07/09/14 10:28 PM, Vijay Ganesan wrote:

But I can't seem to connect using ldaps://localhost:636 using Apache Directory Studio client. I get a "Error while opening connection - Cannot connect on the server: Connection refused" error. I can connect fine using ldap://localhost:389.

Like Udai wrote, ldaps is deprecated, and if possible you should use STARTTLS on the LDAP port (389) instead. But if you really need ldaps, then edit /etc/default/slapd, add ldaps:/// to the SLAPD_SERVICES line, and restart slapd.

What diagnostics can be run to figure out if TLS is working correctly?

LDAPTLS_CACERT=/path/to/ca.pem ldapwhoami -H ldap://server -x -ZZ

Add '-d1' to see some debugging information, including more detailed info from the TLS library.