I have a Windows 2003 server running as a Certificate Authority. I have signed a certificate for use on my Windows 2003 domain controller and successfully used this set-up to allow secure LDAP authentication on my mediawiki installation (running on Ubuntu 10.04).
With a Bugzilla installation on another Ubuntu server I can authenticate without SSL and see user information with Wireshark.
To set up the SSL comms with LDAP I changed the URI to ldaps://mydc.mydomain.local. I can see text that refers to details I placed in the domain controller certificate but no id or passwords. Which is good.
The problem is I can still login using SSL when I remove the certificate from my CA from /etc/ssl/certs (and do dpkg-reconfigure ca-certificates). In /etc/ldap/ldap.conf I have added
TLS_CACERTDIR /etc/ssl/certs
It looks like bugzilla will use SSL with whatever passes it a public key. Is this not safe and is there a way to ensure it checks the ca-certificates? Can I be sure that the communications between the Ubuntu server and Active Directory are really secure?
Further info - if I remove the LDAP server certificate (whilst retaining the bugzilla settings to use ldaps or ldap-with-tls-on-connection then I get no communication so it is definitely using the certificate. I looked through the code trying to see where SSLeay was used (had to install that to get the ldaps working) but Perl isn't my thing so nothing jumped out at me. I was hoping to find where the SSL module is configured to look for certificates.
Saw some documentation on SSLeay and added the following ENV variables to the apache default file but it did not seem to help.
SetEnv HTTPS_CA_FILE /etc/ssl/certs/ca-certificates.crt
SetEnv HTTPS_CA_DIR /etc/ssl/certs
