0

I run a bunch of servers, some run Ubuntu 12.04, and some run Centos 6.3 . Recently, the self-signed SSL certificate on my ldap server expired, so I generated a new one, and distributed it to all the Apache2 servers that need it to connect to the ldap server to run authentication. All of the Apache 2 servers running on Ubuntu worked fine, drop in the new cert and everything is happy. On Centos however, everything is still failing with the new cert. If I switch to using unencrypted ldap, they work again.

I've done a ton of research on this, and I've found these items which exactly describe my situation:

https://issues.apache.org/bugzilla/show_bug.cgi?id=50630

can't figure out why apache LDAP auth fails

Sadly, I've tried adding the "LDAPVerifyServerCert Off" to my config, and that has not helped. Any other suggestions would be appreciated.

EDIT 1: I've done some more digging and I've found a lot of talk about recent Centos ldap packages being build against NSS instead of OpenSSL, and that casing problems. One example: http://www.openldap.org/lists/openldap-technical/201303/msg00162.html

So, meta-question, has anyone run down this path to solve SSL-related problems? Did it succeed?

Improve this question
3
  • What specific error message(s) are you getting?
    – voretaq7
    Aug 2, 2013 at 18:45
  • The only error I'm getting is a 500 in the browser. On the apache server I see: auth_ldap authenticate: user qhartman authentication failed; URI / [LDAP: ldap_simple_bind_s() failed][Can't contact LDAP server] Which is not only unhelpful, it's a red herring, it's contacting the ldap server fine. On the ldap server side, I'm not seeing anything at all.
    – qhartman
    Aug 2, 2013 at 19:23
  • OK, tweaked the logging on the ldap server, and now I'm seeing: connection_read(104): TLS accept failure error=-1 Which isn't super helpful, but it's better than nothing...
    – qhartman
    Aug 2, 2013 at 19:46

1 Answer 1

Reset to default
1

I managed to fix this problem by installing the berkelydb and openldap packages found here:

http://ltb-project.org/wiki/download

The difference is that redhat has started linking things against nss instead of openssl for ssl support. In this case, that breaks all the things. Installing these packages (which are linked against openssl) fixes the problem. Just get the packages and run:

yum install berkeleydb-ltb* openldap-ltb*

restart apache, and hooray, problem solved.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .