Hello,

Is there a unit tester where the client LDAP_OPT_X_TLS_REQUIRE_CERT option is set to LDAP_OPT_X_TLS_NEVER that I can try? I was looking at openldap-2.4.44/clients/tools/ldapsearch but it doesn't configure this option.

My application program sets LDAP_OPT_X_TLS_NEVER. Why does LDAP client still check for server certificate which fails in the case of bad certificate?

int opt; opt = LDAP_OPT_X_TLS_NEVER; ldap_retcode = ldap_set_option(m_tLDAP, LDAP_OPT_X_TLS_REQUIRE_CERT, &opt); ...

Daniel

-----Original Message----- From: Daniel Le Sent: Monday, June 19, 2017 3:58 PM To: 'Paulm' paulm@tetrardus.net Cc: openldap-technical@openldap.org Subject: RE: Using TLS

I rebuilt with libssl (an OpenSSL library which supports SSL and TLS) and that worked. Thanks.

However, I got into the connect error "14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed (self signed certificate)", even though the LDAP_OPT_X_TLS_REQUIRE_CERT option is set to LDAP_OPT_X_TLS_NEVER. Isn't LDAP client supposed to bypass server certificate validation when LDAP_OPT_X_TLS_NEVER is configured?

Daniel

-----Original Message----- From: Paulm [mailto:paulm@tetrardus.net] Sent: Sunday, June 18, 2017 10:13 PM

On Fri, Jun 16, 2017 at 03:26:20PM +0000, Daniel Le wrote:

Hi,

I'm seeing some critical error which causes the application program to exit/terminate when ldap_start_tls_s(LDAP-handle, NULL, NULL) is called. Tracing the code execution, ldap_start_tls_s => ldap_int_tls_start => tls_init, it appears the crash is at the statement "return impl->ti_tls_init()" in the tls_init function.

Can someone give a pointer to help debugging this? And does OpenLDAP need to be linked to OpenSSL library for TLS to work?

If your ldap libs are linked to gnutls, then it might be worthwhile to rebuild and link to the openssl library; then test your code again.

I don't use gnutls because it has given me problems.

I use LDAPv3, port 389 and the default LDAP_OPT_X_TLS_NEVER option. HAVE_TLS is defined but not LDAP_R_COMPILE.

Thanks,

Daniel