Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I run a bunch of servers, some run Ubuntu 12.04, and some run Centos 6.3 . Recently, the self-signed SSL certificate on my ldap server expired, so I generated a new one, and distributed it to all the Apache2 servers that need it to connect to the ldap server to run authentication. All of the Apache 2 servers running on Ubuntu worked fine, drop in the new cert and everything is happy. On Centos however, everything is still failing with the new cert. If I switch to using unencrypted ldap, they work again.

I've done a ton of research on this, and I've found these items which exactly describe my situation:

https://issues.apache.org/bugzilla/show_bug.cgi?id=50630

can't figure out why apache LDAP auth fails

Sadly, I've tried adding the "LDAPVerifyServerCert Off" to my config, and that has not helped. Any other suggestions would be appreciated.

EDIT 1: I've done some more digging and I've found a lot of talk about recent Centos ldap packages being build against NSS instead of OpenSSL, and that casing problems. One example: http://www.openldap.org/lists/openldap-technical/201303/msg00162.html

So, meta-question, has anyone run down this path to solve SSL-related problems? Did it succeed?

share|improve this question
    
What specific error message(s) are you getting? –  voretaq7 Aug 2 '13 at 18:45
    
The only error I'm getting is a 500 in the browser. On the apache server I see: auth_ldap authenticate: user qhartman authentication failed; URI / [LDAP: ldap_simple_bind_s() failed][Can't contact LDAP server] Which is not only unhelpful, it's a red herring, it's contacting the ldap server fine. On the ldap server side, I'm not seeing anything at all. –  qhartman Aug 2 '13 at 19:23
    
OK, tweaked the logging on the ldap server, and now I'm seeing: connection_read(104): TLS accept failure error=-1 Which isn't super helpful, but it's better than nothing... –  qhartman Aug 2 '13 at 19:46
add comment

1 Answer

up vote 1 down vote accepted

I managed to fix this problem by installing the berkelydb and openldap packages found here:

http://ltb-project.org/wiki/download

The difference is that redhat has started linking things against nss instead of openssl for ssl support. In this case, that breaks all the things. Installing these packages (which are linked against openssl) fixes the problem. Just get the packages and run:

yum install berkeleydb-ltb* openldap-ltb*

restart apache, and hooray, problem solved.

share|improve this answer
    
Don't forget to come back later and accept your answer. –  Tom O'Connor Aug 2 '13 at 22:00
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.