I am trying to configure TLS for SLAPD, but it keeps failing with the error "TLS init def ctx failed". I was able to trace the error to the system call where the daemon tries to open the CA certificate file (
open("/etc/ssl/certs/ca.crt", O_RDONLY) = -1 EACCES). It opens the CRT file with the O_RDONLY flag and gets EACCES as the response. However, the file itself is world readable. Furthermore, I ran
sudo -u openldap cat /etc/ssl/certs/ca.crt and the file outputs just fine (openldap is indeed the user and group of the daemon). Any advice?
Permissions on file are 644 owned by root:root, and permissions on all parent directories are 755 owned by root:root. I tried changing owner/group to openldap and also tried changing permissions to 777. Also tried moving the file to /, all with no luck. Also tried running as root, i.e., running without the -u and -g options, and it still fails.
Last lines of strace output: http://paste.ubuntu.com/1147299/