Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm trying to send my GPG public key to our LDAP server, but I'm hitting a wall. My LDAP server only allows LDAP with Start_TLS over port 389, or LDAPS on port 636. I've got the following lines in my gpg.conf file in my .gnupg directory:

keyserver ldap://<fqdn of server>
keyserver-options debug
keyserver-options binddn="cn=admin,dc=com"
keyserver-options bindpw=<admin password>
keyserver-options ca-cert-file <path to servers ssl cert>
keyserver-options tls=try
keyserver-options verbose
keyserver-options no-check-cert

However, when I try to send my key using gpg --send-keys <key id> I get the following errors:

res_errno: 13, res_error: <TLS confidentiality required>, res_matched: <>
ldap_free_request (origid 2, msgid 2)
gpgkeys: unable to retrieve LDAP base: Confidentiality required
gpg: keyserver internal error
gpg: keyserver send failed: Keyserver error

There's a lot more output since I'm running it in debug and verbose, but these seems like the only relevant part. I can post the rest if needed.


share|improve this question
Do you get the same error if you just use ldaps:// instead of trying STARTTLS over port 389? – larsks Aug 5 '13 at 19:06
When I try ldaps://<server>:636 or ldaps://<servername> I get errors indicating that it doesn't trust the certificate because it is unsigned: TLS certificate verification: Error, unable to get local issuer certificate TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed (unable to get local issuer certificate). – WildVelociraptor Aug 5 '13 at 19:26
What version of OpenLDAP (and GPG) are you using, and what distribution are you using? – larsks Aug 5 '13 at 20:07
On my laptop running Mac OS, OpenLDAP 2.4.28, and gpg 2.0.19. OpenLDAP 2.4.28 on the server, which is running Ubuntu 12.04. – WildVelociraptor Aug 5 '13 at 20:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.