Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have followed the instructions found here up to the point where ldapsearch is executed with -ZZ. The problem is after executing ldapsearch with -ZZ, there is no more response.

Is there any step that the guide has missed? Also, I made sure that I have followed each step accordingly.

share|improve this question

Your problem may be the lack of the "olcTLSCACertificateFile" directive together with olcTLSCertificateFile and olcTLSCertificateKeyFile. Point it at the same olcTLSCertificateFile, because for what I see in that doc, you are using a self signed certificate.

  olcTLSCACertificateFile: /etc/pki/tls/certs/slapdcert.pem

You can also use the debug option in ldapsearch to get more information about the error, like this:

  ldapsearch -d256 <your other parameters here>

Check the loglevel directive in "man slapd.conf" to learn more about specifying the debug levels.

share|improve this answer
Thanks for the response! I'll try it out ASAP. – Carlo Oct 9 '12 at 6:17

i had the same trouble on my machine and i finally figured out what was wrong. i configured a cert file as olcTLSCACertificateFile and the file contained two certificates: one of the Root CA and one for the SubCA. It seems that slapd was unable to parse the file and stopped working. There was no hint and no clear error message from slapd.

i hope this hint might help somebody when running into the same trouble.

share|improve this answer
up vote 0 down vote accepted

Apparently, the problem arises from OpenLDAP's use of Mozilla NSS's certutil.

There appears to be no response since the certificate database does not have a certificate with the same name indicated in cn=config.ldif's olcTLSCertificateFile attribute. The default name is "OpenLDAP Server".

To solve this simply look for the script which generates a self-signed certificate for the LDAP server. Do not forget to restart the LDAP daemon for the changes to take effect.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.