Put your intermediate cert and CA cert in the TLSCACertificateFile specified by your
slapd.conf (or olsTLSCA... if using slapd.d).
And the server will include the chain correctly automagically. :)
openssl s_client -connect [host]:636 -showcerts </dev/null
From that, you should see the chain.
FWIW: I looked at the later mentioned FMs and Admin Guide and none seem include the word
'chain' (except for chaining - a different topic), which is how I would look to
see how to configure or verify the server will include the chain. The issue of chains is
either not addressed or talked about in a way that isn't obvious or simply hard to
find. Frankly, had I your concerns and current config, I would have been just as confused.
My first hints on how to correctly configure this from your starting point where by
searching Google for openldap cert "chain" which helped me find this post:
Here's how I have it configured:
# grep TLS.*File slapd.conf
I do NOT have the internal CA we use to sign our certs configured on our host OS; which
will explain the error:num=19 you'll see below.
OpenLDAP /is/ configured to trust the cert, openssl doesn't because the systems
Here's what the command returns for me (scrubbed):
# openssl s_client -connect localhost:636 -showcerts </dev/null
depth=2 C = US, O = [internal CA]
verify error:num=19:self signed certificate in certificate chain
0 s:/C=[host cert]
1 s:/C=[signing/intermediate cert]
i:/C=[root CA cert]
2 s:/C=[root CA cert]
i:/C=[root CA cert]
No client certificate CA names sent
SSL handshake has read 3941 bytes and written 438 bytes
New, TLSv1/SSLv3, Cipher is CAMELLIA256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Protocol : TLSv1
Cipher : [snipped because paranoid corp security staff]
Master-Key: [snipped because paranoid corp security staff]
Key-Arg : None
Krb5 Principal: None
PSK identity: None
PSK identity hint: None
Start Time: 1408032684
Timeout : 300 (sec)
Verify return code: 19 (self signed certificate in certificate chain)
I hope this helps,
From: openldap-technical [mailto:firstname.lastname@example.org] On Behalf Of
Sent: Wednesday, August 13, 2014 10:25 PM
Subject: CA and Intermediate Certificates
We are currently assessing changing our TLS Certificate setup.
We have been using a self-signed CA to issue certificates for our OpenLDAP setup, which
has required us to supply the CA to anyone outside our organisation that wishes to use our
OpenLDAP over TLS or SSL.
We're currently starting to migrate our certificates to AusCERT, as we get a good deal
as a University. As AusCERT is an intermediate CA, so we need to use a chain to get this
The server side works, as per the documentation, by adding the intermediate CA with the
root CA in the olcTLSCertificateCAFile.
This means that we need to install the intermediate certificate on clients that connect to
our LDAP using SSL or TLS. Admittedly this isn't vastly different to what we need to
do now in supplying our own CA.
Looking at our Linux clients in particular, we need to add an appropriate TLS_CACERT
directive to our openldap/ldap.conf. Is the intention, then, to point the client at the
appropriate CA files? Is there a reason that OpenLDAP doesn't use the regular system
CA store? Is there any reason for us not to point to the CA store that's already
University of New England
Armidale NSW 2351
p: 02 6773 4098
This message is private and confidential. If you have received it in error, please notify
the sender and remove it from your system.