On Tuesday, 8 February 2011 19:11:52 Michael Starling wrote:

I'm running openldap-2.3.43-12.el5 on a RHEL 5.5 system:

I believe I have TLS encryption working but I'd like to be able to verify my client connections.

On my LDAP server I have the following in slapd.conf

TLSCipherSuite HIGH:MEDIUM:+TLSv1:!SSLv2:+SSLv3 TLSCertificateFile /etc/openldap/cacerts/slapdcert.pem TLSCertificateKeyFile /etc/openldap/cacerts/slapdkey.pem TLSCACertificateFile /etc/openldap/cacerts/slapdcert.pem

So, a self-signed cert? You may want to reconsider this, if you will ever have more than one LDAP server, and depending on how many clients you have.

You may want to supply the output of: openssl x509 -noout -subject -in /etc/openldap/cacerts/slapdcert.pem

On the client I have the following in /etc/ldap.conf

uri ldaps://10.70.5.67/

So, the subject CN on the certificate is 10.70.5.67? You may instead want to have the subject CN on the cert be the hostname, and use *that* hostname, exactly, in the uri.

Please compare to HTTPS browser validation .. the certificate needs to match the server address you have specified you want to connect to, not some other arbitrary attribute of this server (e.g. the IP address).

(there are other options to allow IP addresses, but they require more work)

ssl on tls_cacertfile /etc/openldap/cacerts/slapdcert.pem tls_checkpeer no

On the client /etc/openldap/ldap.conf

URI ldaps://10.70.5.67/

Again, ensure the host portion of the URI matches the name on the cert.

TLS_CACERT /etc/openldap/cacerts/slapdcert.pem TLS_REQCERT demand

These commands work both from the client and server.

openssl s_client -connect servername:636 -showcerts

ldapsearch -x -H ldaps://servername -b dc=domain,dc=domain -D cn=root,dc=domain,dc=domain -W

So, here you use the hostname, but in *all* the other instances you use the IP? Why?

So my first question would be does this guarantee encrypted sessions?

Does *what* guarantee encrypted connections? Your client configurations ensure that the clients use encrypted connections, but your server configuration does not prevent unencrypted connections from working.

Second, if I change tls_checkpeer to yes then I can't contact the LDAP server. How can I verify my clients?

This is about the server certificate validation, which means server certificate validation rules need to be satisfied: -chain of trust from CA cert to server cert -date validity -matching of cert subject and host portion of URI

Regards, Buchan