Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have installed openldap 2.4.23 on CentOS 6.3 using the yum package 'openldap-servers'.

When I follow instructions to configure openldap for SSL (such as http://www.overclockers.com/forums/showthread.php?t=707070 or http://itdavid.blogspot.ca/2012/05/howto-centos-6.html), everything seems good when I bounce LDAP- the port is open, so it appears the server is listening.

However, when I attempt to connect via LDAPS, the client and server hang. Connecting via openssl_client gives the same behaviour (it displays CONNECTED and then hangs). Nothing appears in the system log or openldap logs.

What gives?

(Note: I figured it out and want to save anyone else the aggravation- just posting it as a question in order to follow ServerFault posting guidelines).

share|improve this question
    
And the answer that I found is... The 'openldap-servers' package now automatically configures SSL as part of the installation. There is no need to follow any procedure to enable it. In fact, if you do so, you will break LDAPS. Note: It also appears that the package now uses the Netscape cert format (/etc/openldap/certs/key3.db and cert8.db. In order to get the certificate for client use, I used the openssl to grab the cert (openssl s_client -showcerts -connect ldap_server:636 > server.crt) and then make it available to the client. There may be a better way. –  Gerald Boersma Sep 25 '12 at 19:32
    
There are two ways that you can configure SSL with OpenLDAP: TLS with start_tls command that runs on standard 389 port or SSL/TLS config that resides on different port and services only SSL connections. –  Hubert Kario Oct 6 '12 at 15:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.