Hello everyone, I hope Im at the right place for these kind of question, please tell me if I’m wrong.

I just installed openldap as a proxy for AD. The proxy in itself works fine, I have made a few ldapsearch and got result I was expecting.

Now I want to add TLS to it for security reason.

I’m using openldap 2.4.42 on Ubuntu 16.04.1 LTS unfortunately it’s built with gnutls which I don’t know much about I would have preferred it to be built with openssl.

So Im trying to make TLS work so I added these to slapd.conf

TLSCipherSuite HIGH:!NULL TLSCACertificateFile /etc/SSL/LDAP/certificate_chain.cer.pem.gnutls TLSCertificateFile /etc/SSL/LDAP/p01ldp5001.cer.pem TLSCertificateKeyFile /etc/SSL/LDAP/p01ldp5001.key.pem TLSVerifyClient never security ssf=128

I also used certtool (gnutls tool) to validate my certificate

I can verify my certificate_chain.cer.pem.gnutls with certtool so the file in itself is okay.

certtool -e --infile certificate_chain.cer.pem.gnutls Loaded 2 certificates, 1 CAs and 0 CRLs

Subject: C=CA,ST=Quebec,O=Promutuel CES,OU=Operations,CN=Promutuel HWS Intermediate CA 1 Issuer: C=CA,ST=Quebec,L=Quebec,O=Promutuel CES,OU=Operations,CN=Promutuel HWS Root CA Checked against: C=CA,ST=Quebec,L=Quebec,O=Promutuel CES,OU=Operations,CN=Promutuel HWS Root CA Output: Verified. The certificate is trusted.

Chain verification output: Verified. The certificate is trusted.

I can also verify the whole chain if I make a file containing the 3 certs, CA, Intermediate and Server

certtool -e --infile full_chain.pem --verify-hostname p01ldp5001.services.local --verify-purpose 1.3.6.1.5.5.7.3.1 Loaded 3 certificates, 1 CAs and 0 CRLs

Subject: C=CA,ST=Quebec,O=Promutuel CES,OU=Operations,CN=Promutuel HWS Intermediate CA 1 Issuer: C=CA,ST=Quebec,L=Quebec,O=Promutuel CES,OU=Operations,CN=Promutuel HWS Root CA Checked against: C=CA,ST=Quebec,L=Quebec,O=Promutuel CES,OU=Operations,CN=Promutuel HWS Root CA Output: Verified. The certificate is trusted.

Subject: C=CA,ST=Quebec,L=Quebec,O=Promutuel CES,OU=Operations,CN=p01ldp5001.services.local Issuer: C=CA,ST=Quebec,O=Promutuel CES,OU=Operations,CN=Promutuel HWS Intermediate CA 1 Checked against: C=CA,ST=Quebec,O=Promutuel CES,OU=Operations,CN=Promutuel HWS Intermediate CA 1 Output: Verified. The certificate is trusted.

Chain verification output: Verified. The certificate is trusted.

Yet when I try to start the server I get this error

main: TLS init def ctx failed: -1

Can someone help me with this?

Patrick Ouellet [ligne] Administrateur Linux Operation VPSI [promutuel-assurance] Groupe Promutuel 2000, boulevard Lebourgneuf, 4e étage, Québec (Québec) G2K 0B6 [tel] 418 840-1188, poste 2393 / 1 800 510-4630 [telec] 418 840-9900 promutuelassurance.cahttps://www.promutuelassurance.ca/

Si vous devez imprimer ce document, faites-le recto verso. Si vous n'êtes pas le destinataire de ce message, veuillez le détruire après avoir informé l'expéditeur de son erreur. Par ailleurs, il est interdit de copier ou de modifier tout courriel sans l'autorisation de l'auteur. Promutuel Assurance n'assume aucune responsabilité à l'égard du contenu des messages personnels envoyés par ses employés.

If you need to print this document, please print it double-sided. If you are not the intended recipient of this message, please notify the sender of the error and destroy the message. Please further note that it is prohibited to copy or modify any email without the author’s permission. Promutuel Insurance accepts no liability whatsoever with regard to the content of personal messages sent by its employees.