Hello, all.

I'm using the LTB packages for OpenLDAP 2.5.20 and trying to configure ldaps access. To that end, I have obtained a certificate signed by Allianz Infrastructure CA V, a sub-CA of Allianz Root CA III.

https://rootca.allianz.com/en/rootca3.htm

I have put: * the certificates of the two CA in /etc/openldap/certs/ldap-ca.crt * the server certificate in /etc/openldap/certs/ldap.crt * the private key in /etc/openldap/certs/ldap.key

All files are owned by the 'ldap' user and are readable.

Over in slapd.conf, I have configured TLSCACertificateFile, TLSCertificateFile and TLSCertificateKeyFile with the correct filenames and have restarted slapd.

An "openssl s_client -connect ..." gives a verify return code of 0 (ok) but an "ldapsearch -x ... -d 1" gives me the following error:

TLS trace: SSL_connect:SSLv3/TLS read server hello TLS trace: SSL_connect:TLSv1.3 read encrypted extensions TLS certificate verification: depth: 2, err: 19, subject: /C=DE/O=Allianz/CN=Allianz Root CA III, issuer: /C=DE/O=Allianz/CN=Allianz Root CA III TLS certificate verification: Error, self signed certificate in certificate chain tls_write: want=7, written=7 0000: 15 03 03 00 02 02 30 ...0 TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_connect:error in error TLS: can't connect: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed (self signed certificate in certificate chain). ldap_err2string ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)

Now, it's true that Root CA III is self-signed but that's true of any root CA. Both Infra V and Root III are trusted by the system and show up when I run "trust list --filter=ca-anchors".

Am I doing something wrong?

Regards, Emmanuel