Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to connect to multiple different LDAPS servers. A lot of the documentation I've seen recommends setting TLS_REQCERT never, but that strikes me as horribly unsecure to not verify the certificate. So I've set that to demand.

All the documentation I've seen says I need to update ldap.conf with a TLS_CACERT directive pointing to a .pem file. I've got that .pem file set up with the certificate from LDAP Server #1, and ldaps connections are happening fine.

I've now got to communicate securely with another LDAP server in another branch of my organization, that uses a different certificate. I've seen no documentation on how to do this, except 1 page that says I can simply put multiple (not chained) certificates in the same .pem file. I've done this and everything is working hunky dorey.

However, when I told a colleague what I did, he sounded like the sky was falling - putting 2 non-chained certificates into one .pem file is apparently the worst thing since ... ever.

Is there a more acceptable way to do this? Or is this the only accepted way?

share|improve this question
very interested in why myself. I mean you just put the public version of the cert into the PEM file, so not sure why it's such a big deal. – emynd Jul 3 '13 at 16:41
I'm interested as well. Public keys are, well ...public. – Nathan C Jul 3 '13 at 17:14
His argument (when he was able to invent one) was - what if the file gets corrupted? Then you've lost both your certificates in one file. I thought that reasoning was tenuous at best. – Pickle Jul 3 '13 at 17:52
hence the reason for a backup solution :P – emynd Jul 3 '13 at 18:03
up vote 0 down vote accepted

Bundling unrelated certificates isn't an uncommon practice. It is the way that RedHat manages its CAs. However, that method can make it more difficult to remove certificates you no longer wish to trust. Perhaps you'd like to go the hashed certificate directory method. This is the way that debian manages its CAs.

  1. Put your certificates into a a single directory (e.g. /etc/ldap/cacerts).
  2. Run c_rehash with root privileges against your CA certificate directory (e.g. sudo c_rehash /etc/ldap/cacerts).
  3. Remove your TLS_CACERT option and set TLS_CACERTDIR to point to your CA certificates directory.
  4. Remember to run c_rehash every time you add a certificate and run sudo find -L /etc/ldap/cacerts -type l -exec rm {} + every time you remove one. (Re-running the command without altering anything doesn't have any ill effects, but is pointless.)
share|improve this answer
TLS_CACERTDIR is ignored by GNUtls, which is what openldap is linked to on Debian. Otherwise ya - that'd be the way to go. If it's not an uncommon practice, then I'll just leave it as-is because honestly your method seems like a (relatively) lot of work. Removing certificates shouldn't be a problem in the .pem file because there are only 2 certificates, and they're clearly labelled. Thanks for your answer though. – Pickle Jul 5 '13 at 19:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.