Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am using .htaccess to ask for a username and passphrase which authenticates against LDAP.

The problem is, that the certificate is corrupt, and so Apache of course won't allow users to login.

As the LDAP server is managed by someone else, it can take days before the certificate is fixed.

The problem

If I try to connect to the AD using Jxplorer I get

javax.naming.CommunicationException: simple bind failed: example.com:636
[Root exception is javax.net.ssl.SSLHandshakeException:
java.security.cert.CertificateException: Invalid Server Certificate:
server certificate could not be verified, and the CA certificate is
missing from the certificate chain. raw error:
sun.security.validator.ValidatorException: PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException:
unable to find valid certification path to requested target]

If I

openssl s_client -showcerts -connect example.com:636

and parse the first certificate into

openssl x509 -text -in filename

then Subject: is empty, which it shouldn't be to my understanding.

Question

Is there a way to make Apache accept/ignore that the certificate is missing the Subject, so users can still authenticate to the website?

Update

httpd.conf

<Directory "/var/www/cgi-bin">
    AllowOverride All
    Options None
    Order allow,deny
    Allow from all
</Directory>

.htaccess

Order deny,allow
Deny from All
Options FollowSymLinks
AuthName "Example"
AuthType Basic
AuthBasicProvider ldap
AuthzLDAPLogLevel debug
AuthLDAPBindDN "CN=example,OU=example,DC=example,DC=com"
AuthLDAPBindPassword "xxx"
AuthLDAPURL  "ldaps://example.com/DC=example,DC=com?sAMAccountName?sub?(objectClass=user)"
Require ldap-group CN=example,OU=example,DC=win,DC=example,DC=com
AuthzLDAPAuthoritative on
Satisfy any
AuthUserFile /dev/null
require valid-user
share|improve this question
    
What does your the part of apache config that deals with ldap authentication look like? –  Jenny D Apr 11 '13 at 12:19
    
Do you mean the .htaccess file? –  Sandra Apr 11 '13 at 12:20
    
If that's where you've put the config, then yes. –  Jenny D Apr 11 '13 at 12:42
    
Now added httpd.conf and .htaccess –  Sandra Apr 11 '13 at 12:42
    
Thanks, that makes it clear just how the connection is made. I'm guessing you'll get the same problem if you do ldapsearch with the same values from the command line? If so, we can remove apache from the equation (because then it's strictly an LDAP problem) and start looking at that config instead. –  Jenny D Apr 11 '13 at 16:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.