4

I'm trying to set up SSL with a server running OpenLDAP (and using OpenSSL, not GnuTLS).

The server seems to be working fine: I can authenticate using ldap:// and can also use ldaps:// from Apache Directory Studio. I can use LDAPS from the client as well, as long as I have this setting in /etc/ldap.conf:

tls_checkpeer no

As soon as I try to use tls_checkpeer yes the SSL connection is refused.

I have the following settings on the server:

olcTLSCACertificateFile  /etc/ssl/certs/cacert.pem
olcTLSCertificateFile    /etc/ssl/private/newcert.pem
olcTLSCertificateKeyFile /etc/ssl/private/newreq.pem

The client has these related entries:

# ssl on
uri ldaps://192.168.1.15
tls_checkpeer no
# tls_cacertdir /etc/ssl/certs
# tls_cacertfile /etc/ssl/certs/cacert.pem

The file /etc/ssl/certs/cacert.pem is accessible to users for reading. With the above configuration, it works. If I uncomment one of the two commented tls_* configuration entries and change to tls_checkpeer yes it fails.

I've tried using both cacert.pem and newcert.pem for the certificate (tls_cacertfile) and it didn't work. The cacert.pem has a -----BEGIN CERTIFICATE----- section, as does newcert.pem.

However, the cacert.pem has this under X509v3 extensions:

X509v3 Basic Constraints: 
    CA:TRUE

...and the newcert.pem file has this in the same section:

X509v3 Basic Constraints: 
    CA:FALSE
Netscape Comment: 
    OpenSSL Generated Certificate

Other certificates in /etc/ssl/certs have nothing in them except the block marked by BEGIN CERTIFICATE.

Using this command:

openssl s_client -connect 192.168.6.144:636 -showcerts

I can see the contents of cacert.pem and newcert.pem being used for the session.

I've not made changes to /etc/ldap/ldap.conf on either the client or the server.

Errors from the client include:

Feb  8 14:32:24 foo nscd: nss_ldap: could not connect to any LDAP server as cn=admin,dc=example,dc=com - Can't contact LDAP server
Feb  8 14:32:24 foo nscd: nss_ldap: failed to bind to LDAP server ldaps://bar: Can't contact LDAP server
Feb  8 14:32:24 foo nscd: nss_ldap: could not search LDAP server - Server is unavailable

There's no special log entries on the server. The client is Ubuntu Lucid Lynx 10.04, as is the server. All are using nscd.

Attempting to replicate the problem on a Red Hat Enterprise Linux 5.7 system fails in the opposite direction: something that should probably fail, does not: using tls_checkpeer yes with an empty tls_cacertdir directory. I need SSL to work on both systems; we have a mix of both Ubuntu and RHEL.

I restarted nscd after each configuration change.

These are my actual questions:

  • How do I get the tls_checkpeer option working? (main question)
  • Does ssl on actually do anything on the client?

Thanks.

3
  • It doesnt like your cert, guessing its self signed, and the cacert.pem is the CA cert you used to sign it. Also the man page I'm looking at says that the parameter to specify your cacert with in ldap.conf is TLS_CACERT, not tls_cacertfile (whether case matters, I cant remember).
    – phemmer
    Feb 8, 2012 at 23:41
  • There are two ldap.conf files: /etc/ldap.conf and /etc/ldap/ldap.conf. My understanding is that TLS_CACERT would be in the latter, and tls_cacertfile would be in the former. It is also my understanding that the former is for LDAP clients like PAM and NSS, and the latter is for the LDAP server (but I could be wrong about that.)
    – Mei
    Feb 9, 2012 at 0:07
  • Many of the options are compatable between the two. And all LDAP libraries ignore options that they dont know. This is why on all our systems at work we symlink all the ldap.conf files to point at a single file. However you are correct, the man page for that option is the openldap version. For some reason I thought you were using ldapsearch to test this with, but going back and re-reading, I apparently made that bit up :-P
    – phemmer
    Feb 9, 2012 at 1:21

1 Answer 1

2

In both client and server try adding the following to /etc/ldap/ldap.conf

TLS_REQCERT never

By the way SSL appears to be deprecated in openldap and it's better to use TLS. See http://httpd.apache.org/docs/2.2/mod/mod_ldap.html search for "OpenLDAP SDK". Configuration is the same except you will use port 389 and not use "ldaps://" in the uri.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .