Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to configure TLS for SLAPD, but it keeps failing with the error "TLS init def ctx failed". I was able to trace the error to the system call where the daemon tries to open the CA certificate file (open("/etc/ssl/certs/ca.crt", O_RDONLY) = -1 EACCES). It opens the CRT file with the O_RDONLY flag and gets EACCES as the response. However, the file itself is world readable. Furthermore, I ran sudo -u openldap cat /etc/ssl/certs/ca.crt and the file outputs just fine (openldap is indeed the user and group of the daemon). Any advice?


Permissions on file are 644 owned by root:root, and permissions on all parent directories are 755 owned by root:root. I tried changing owner/group to openldap and also tried changing permissions to 777. Also tried moving the file to /, all with no luck. Also tried running as root, i.e., running without the -u and -g options, and it still fails.

Last lines of strace output:

share|improve this question
Can you post a few lines of strace output? Are you certain slapd is running as the openldap user? Can you show us the permissions on both /etc/ssl/certs/ca.crt and /etc/ssl/certs? Can you show us the TLS-related portions of your slapd.conf`? – larsks Aug 14 '12 at 18:03
Are you sure it is failing only for the CA certificate? What about the Server certificate and it's key? Could you paste your slapd.conf and ls -l of your certificates? – Chida Aug 14 '12 at 18:05
Added requested info to the question. Also, it does not seem to even be attempting to open the other files once it fails to open the CA cert file. – parent5446 Aug 14 '12 at 18:11
up vote 3 down vote accepted

AppArmor is probably denying access to the file, check /var/log/kern.log to confirm this:

grep audit /var/log/kern.log

If this is the case, edit /etc/apparmor.d/usr.sbin.slapd and give it permission to this file.

/etc/ssl/certs/ r,
/etc/ssl/certs/* r,

Run sudo service apparmor reload after modifying the profiles.

share|improve this answer
This was indeed the case. Can't believe I didn't think of that. Unfortunately, slapd is now giving me other troubles. :P – parent5446 Aug 14 '12 at 22:47

This smells a lot like SELinux or some other security module. Is selinux enabled? You can look in /var/log/audit/audit.log for messages indicating that selinux has blocked an operation. You can also try disabling selinux by running:

# setenforce 0

And now start up slapd. If it works, this was your problem, and there are two ways to fix it:

  • Persistently disable selinux. Exactly how to do this depends on your distribution.
  • Create an selinux policy that will allow slapd to read from the certificate.

You can use the audit2allow program to generate an appropriate selinux policy.

See mgorven's answer for what to do if you've got AppArmor instead of SElinux.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.