I have a Debian 6.0.5 server running openldap. It appears to be compiled against gnutls. I used gnutls' certtool to generate a self-signed certificate and I have used it on a few debian client machines to authenticate against the openldap server.
However, when I try to do the same on a CentOS 6 client, I get the following error for ldapsearch:
ldap_initialize( <DEFAULT> ) ldap_start_tls: Can't contact LDAP server (-1) additional info: TLS error -8101:Certificate type not approved for application. ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)
If I run gnutls-cli-debug on the CentOS client, I get the following:
gnutls-cli-debug -p 636 ldap.blahblah.com Resolving 'ldap.blahblah.com'... Connecting to '10.6.0.11:636'... Error in %INITIAL_SAFE_RENEGOTIATION Checking for Safe renegotiation support...
And that's it - it dies.
Has anyone been able to do ldaps in this kind of a setup, gnutls linked server, gnutls generated certificate, openssl linked client?