Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have followed the instructions found here up to the point where ldapsearch is executed with -ZZ. The problem is after executing ldapsearch with -ZZ, there is no more response.

Is there any step that the guide has missed? Also, I made sure that I have followed each step accordingly.

share|improve this question
add comment

3 Answers

up vote 0 down vote accepted

Apparently, the problem arises from OpenLDAP's use of Mozilla NSS's certutil.

There appears to be no response since the certificate database does not have a certificate with the same name indicated in cn=config.ldif's olcTLSCertificateFile attribute. The default name is "OpenLDAP Server".

To solve this simply look for the generate-server-cert.sh script which generates a self-signed certificate for the LDAP server. Do not forget to restart the LDAP daemon for the changes to take effect.

share|improve this answer
add comment

i had the same trouble on my machine and i finally figured out what was wrong. i configured a cert file as olcTLSCACertificateFile and the file contained two certificates: one of the Root CA and one for the SubCA. It seems that slapd was unable to parse the file and stopped working. There was no hint and no clear error message from slapd.

i hope this hint might help somebody when running into the same trouble.

share|improve this answer
add comment

Your problem may be the lack of the "olcTLSCACertificateFile" directive together with olcTLSCertificateFile and olcTLSCertificateKeyFile. Point it at the same olcTLSCertificateFile, because for what I see in that doc, you are using a self signed certificate.

  olcTLSCACertificateFile: /etc/pki/tls/certs/slapdcert.pem

You can also use the debug option in ldapsearch to get more information about the error, like this:

  ldapsearch -d256 <your other parameters here>

Check the loglevel directive in "man slapd.conf" to learn more about specifying the debug levels.

share|improve this answer
    
Thanks for the response! I'll try it out ASAP. –  Carlo Oct 9 '12 at 6:17
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.