Hi, folks

I am using the APIs from openldap and recently run into a problem which upset me. Following is the framework of the function.

ldaps_func()

{

LDAP* ld = NULL;

char * uri =" ldaps://xxx.xxx.xxx:636";

.....

ldap_set_option(...); //using LDAP v3

ldap_set_option(...); // set LDAP_OPT_X_TLS_REQUIRE_CERT to deman

ldap_set_option(...); // set LDAP_OPT_X_TLS_CACERTDIR to /tmp/ldapsCA/

ldap_initialize(&ld, uri);

.....

ldap_simple_bind(.....);

ldap_search_ext(...);

......

ldap_unbind(ld);

.....

return 0;

}

Above function is called in a while loop to authenticate users to a LDAPS server when authentication request comes up. This function works fine. BUT after one successful authentication, if I delete CA certificates of server's certificate under /tmp/ldapsCA/, subsequent authentications will STILL succeed. If restart this daemon, no authentication will succeed, because CA certificates under /tmp/ldapsCA/ has been deleted.

Why I delete CA certificates under /tmp/ldapsCA/? I just want to simulate "certificate change".

Is the openssl library cache someting??

Any one has any ideas about this? I will really appreciate it.

Thanks,

Jacky