Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Secure LDAP queries via command-line and PHP to an AD domain controller with a self-signed certificate.

I am working on a project where I need to enable LDAP look-ups from a PHP web application to a MS AD domain controller that is using a self-signed certificate. This self-signed certificate is also using a domain name that is not a FQDN - think of something like people.campus as the domain name. The web application would take the user's credentials and pass them on to the AD domain controller to verify if the credntials are a match or not. This seems simple, but I am having problems trying to get PHP and the self-signed certificate to work.

Some people have suggested that I changed the TLS_REQCERT variable from "request" to "never" within the OpenLDAP configuration. I am concerned that this might have larger implications such as a man-in-the-middle attack and I am not comfortable changing this setting to never. I have also read some places online where one can take a certificate and place it as a trusted source within the openldap configuration file. I am curious if that is something that I could do for the situation that I have? Can I, from the command line, obtain the self-signed certificate that the AD domain controller is using, save it to a file, and then have openldap use that file for the trust that it needs so that I do not need to adjust the variable from request to never? I do not have access to the AD domain controller and as a result cannot export the certificate. If there is a way to obtain the certificate from the command line, what commands do I need to use? Is there an alternate method of handling this issue that would be better in the long run? I have some CentOS servers and some Ubuntu servers that I am working with to try and get this going on.

Thanks in advance for your help and ideas.

share|improve this question
Use the command openssl s_client -connect dc.IPorFQDN:636 -showcerts from the command line to verify the DC allows connections and retrieve the certificates. – Zoredache Mar 18 '11 at 16:45
@Zoredache that command worked. It displayed a lot of stuff on the screen and then just hung. I had to use CTRL-C to exit out of it. – John Mar 18 '11 at 16:54
It didn't hang, it left you with an raw open connection to the server you could send data and get responses. Just like you can use netcat/telnet to debug unencrypted connections you can use the s_client to connect SSL/TLS services and manually send commands. – Zoredache Mar 18 '11 at 16:58
@Zoredache is there a way then that I can extract the certificates to a file with this command so that I can use it with the OpenLDAP configuration to point to this extracted self-signed certificate as a trusted certificate for use with TLS_REQCERT? – John Mar 18 '11 at 17:13
The -showcerts flag causes the cert to be printed out in PEM format during connection (as part of that wall of text, look for -----BEGIN CERTIFICATE-----); drop that in a .pem file and you should be able to trust it. – Shane Madden Mar 18 '11 at 22:08

If your self-signed certificate is signed by your owned authority, you can check if the certificate provided is correct by check the server cert. To do this, add in your ldap.conf the line 'TLS_CACERT /etc/ssl/certs/ca.pem' with ca.pem is the file with public key of your authority. With 'TLS_REQCERT hard', it will check your connection, and refuse to speak if your certificate server is incorrect.

If you have just the certificate, you can MAYBE (I don't try) add your public key to TLS_CERT/TLS_CACERT.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.