Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm migrating from an existing apache+LDAP+mysql+php server to a new hardware platform. Old server is running Debian Lenny, which I have no config documentation available (was done by previous sysadmin); New server is running Ubuntu 10.04.2 LTS 32bit.

After installing Apache and configured LDAP client on the new server, ldapsearch to the LDAP master (another dedicated server) returns results just fine. However, when using apache with https, logs complain that "Can't contact LDAP server".

I'm authenticating using ldaps and can confirm that 636 port is open on the LDAP master. I can't understand why apache would fail while regular ldapsearch is working!

Below is part of the virtualhost config:

<Directory />
                Options FollowSymLinks
                AllowOverride None
                #AuthLDAPEnabled on
                AuthType Basic
                AuthBasicProvider ldap
                AuthName "Private"
                AuthLDAPURL ldaps://,dc=organisation,dc=com?uid
                AuthzLDAPAuthoritative off
                require valid-user
                AddType application/x-httpd-php .php .phtml
                <IfModule mod_php4.c>
                        php_flag magic_quotes_gpc Off
                        php_flag track_vars On
                        php_value include_path .

Any help/suggestion is very much appreciated!

share|improve this question

You need to tell Apache to trust the LDAP server's certificate.

See this.

ldapsearch (and other ldap* binaries) are from the OpenLDAP toolkit. The reason ldapsearch works (and Apache doesn't) is that the previous sysadmin must have placed the certificate the LDAP server is using (or the CA certificate that issued the LDAP server's certificate) into the location the OpenLDAP tools look for certs - generally this is /etc/openldap/cacerts, but it is somewhat distro-dependent.

Go look in that directory.

Once you've found the right certificate, use the mod_ldap directive (see here) to point to it. Place this directive before your LDAP configuration. For example:

If it's the LDAP server's client certificate:

LDAPTrustedGlobalCert CERT_BASE64 /etc/openldap/cacerts/ldap-server.pem

If it's the certificate of the CA that signed the LDAP server's certificate:

LDAPTrustedGlobalCert CERT_CA /etc/openldap/cacerts/ldap-cacert.pem

Use the OpenSSL command line tool to inspect the certificate to determine which it is:

openssl x509 -in /path/to/cert.pem -noout -text
share|improve this answer
Hi superdupersheep thanks for your answer. unfortunately I don't think this is the issue - the .pem certificates are located at /etc/ssl (a customised place??) and /etc/apache2/sites-available/default is pointing to it correctly.... – tw79 Mar 1 '11 at 4:50

There are bugs in libgcrypt11 that cause issues with using GnuTLS 2.10.* or older and those can be worked-around by running nscd on the LDAP client.

sudo apt-get install nscd

With GnuTLS 2.11.* or later the preferred crypto backend changed to nettle. For Ubuntu 12.04 see this bug report:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.