Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to setup openldap on ubuntu 12.04 by following this guide

When I tried to enable TLS on the server by creating a self signed crtificate as decribed in the guide above, I got the following error

command that I ran

ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/ssl/certinfo.ldif

Content of ldif file

dn: cn=config
add: olcTLSCACertificateFile
olcTLSCACertificateFile: /etc/ssl/certs/cacert.pem
add: olcTLSCertificateFile
olcTLSCertificateFile: /etc/ssl/certs/ldap01_slapd_cert.pem
add: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/ssl/private/ldap01_slapd_key.pem

Error Message

ldap_modify: Inappropriate matching (18)
        additional info: modify/add: olcTLSCertificateFile: no equality matching rule

After hours of searching on google, I have not found anything that tells much about this error. Does anyone have any more information on this?

share|improve this question
Not an answer to your question, but once you have it fixed, you may want to force the use of SSL. – Halfgaar Jun 23 '14 at 9:44

These are SINGLE-VALUE. Use replace instead of add.

Also note, changes in the attributes may require a restart of slapd. (Not everything is a run-time configurable as we'd like.)

Your schema is probably:

attributeTypes: ( NAME 'olcTLSCertificateFile' SYNTAX SINGLE-VALUE )
attributeTypes: ( NAME 'olcTLSCertificateKeyFile' SYNTAX SINGLE-VALUE )

A little explaination: ldapmodify add causes slapd to make sure you aren't putting in the attribute valie pair twice by doing an equality match. From what I can tell it should be using NAME 'caseExactOrderingMatch', but I've not sure I've ever tried an add for these attributes. This behavior might be completely normal.

share|improve this answer

The way I enable TLS on an OpenLDAP server is by specifying certain directives in the /etc/openldap/slapd.conf file, for example:

TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt
TLSCertificateFile /etc/pki/tls/certs/servercertificate.cer
TLSCertificateKeyFile /etc/pki/tls/certs/privatekey.key

This example is for a commercially-signed certificate although it also applies for a self-signed. This does need a restart of OpenLDAP though as I'm not aware of a way to ask OpenLDAP to re-read the configuration file without restarting it.

share|improve this answer
he doesn't use a local config file, but instead cn=config for storing and configuring the LDAP server – Daywalker Jan 5 at 7:27

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.