On 11/21/2010 07:36 PM, Howard Chu wrote:
Dieter Klünter wrote:
> Fri, Nov 19, 2010 at 02:58:30PM -0200, Márcio Luciano Donada wrote:
>> Hi list,
>> When using TLS, I have information that I'm using a self-signed
>> certificate, as shown below:
>>
>> # ldapsearch -x -d5 -b 'ou=Usuarios,dc=xx,dc=com,dc=br' -H
>> ldaps://121.1.1.97/ '(objectclass=*)'
>> ldap_url_parse_ext(ldaps://121.1.1.97/)
>> ldap_create
>> ldap_url_parse_ext(ldaps://121.1.1.97:636/??base)
>> ldap_sasl_bind
>> ldap_send_initial_request
>> ldap_new_connection 1 1 0
>> ldap_int_open_connection
>> ldap_connect_to_host: TCP 121.1.1.97:636
>> ldap_new_socket: 3
>> ldap_prepare_socket: 3
>> ldap_connect_to_host: Trying 121.1.1.97:636
>> ldap_pvt_connect: fd: 3 tm: -1 async: 0
>> TLS trace: SSL_connect:before/connect initialization
>> TLS trace: SSL_connect:SSLv2/v3 write client hello A
>> TLS trace: SSL_connect:SSLv3 read server hello A
>> TLS certificate verification: depth: 0, err: 18, subject:
>> /C=AU/ST=Some-State/O=Internet Widgits Pty Ltd/CN=ldap.xx.com.br,
>> issuer:
>> -State/O=Internet Widgits Pty Ltd/CN=ldap.xx.com.br
>> TLS certificate verification: Error, self signed certificate
>> TLS trace: SSL3 alert write:fatal:unknown CA
>> TLS trace: SSL_connect:error in SSLv3 read server certificate B
>> TLS trace: SSL_connect:error in SSLv3 read server certificate B
>> TLS: can't connect: error:14090086:SSL
>> routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed (self
>> signed certificate).
>> ldap_err2string
>> ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)
>
> OpenLDAP is quite picky about correct certificate chains.
No, the software will accept whatever you tell it to use, if you
configure it appropriately.
Agreed. I had to put together a test setup to convince myself first,
but now it makes sense to me. =)
> You really should create a full certificate chain, that is, a ca,
a
> server certificate and a server key.
But yes, the Project always recommends that you do the right thing.
One thing I was wondering here is if his ldap is only accessible from
within one location (i.e. no subnets physically separated that need to
authenticate against this ldap server), self signed would not be a bad
idea.
Otherwise, there is always
cacert.org. That said, using the later could
make it a bit simpler (at the expense of having to renew cert more
often) as the ca is available and easy to deploy to other machines.