Thanks, all, for your responses. Ayer's blog entry and the twitter link it had the
root (heh) explanation we were looking for.
We did in fact import the new root cert into the nss database as a way to get the broken
applications to work. I'm going to continue to try the blacklist approach outlined in
Christian Heimes' tweet.
Howard, I kinda figured this wasn't actually an openldap issue; do you still want
the full output?
From: Howard Chu <hyc(a)symas.com>
Sent: Wednesday, June 3, 2020 2:44 PM
To: Dale Thompson - NOAA Federal <dale.j.thompson(a)noaa.gov>;
Subject: Re: ssl certificate chain
Dale Thompson - NOAA Federal wrote:
I'm not certain the hack redhat added to force openldap to use
nss actually causes openldap to use the nss cert store. My rhel6 openldap servers appear
use the PEM certs they would have used as if redhat never messed with forcing openldap to
use nss, but rather left it at openssl. I did check and slapd is
linked against the nss libs, but using the pem file in /etc/openldap/cacerts.
The fix for this might be as simple as linking the PEM version of the updated cert store
into the directory where openldap is looking.
Redhat adds a custom PKCS#11 module to their NSS that lets it use PEM files. So it can use
their usual certificate DBs or plain PEM files.
-- Howard Chu
CTO, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc/
Chief Architect, OpenLDAP http://www.openldap.org/project/