Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to send my GPG public key to our LDAP server, but I'm hitting a wall. My LDAP server only allows LDAP with Start_TLS over port 389, or LDAPS on port 636. I've got the following lines in my gpg.conf file in my .gnupg directory:

keyserver ldap://<fqdn of server>
keyserver-options debug
keyserver-options binddn="cn=admin,dc=com"
keyserver-options bindpw=<admin password>
keyserver-options ca-cert-file <path to servers ssl cert>
keyserver-options tls=try
keyserver-options verbose
keyserver-options no-check-cert

However, when I try to send my key using gpg --send-keys <key id> I get the following errors:

res_errno: 13, res_error: <TLS confidentiality required>, res_matched: <>
ldap_free_request (origid 2, msgid 2)
ldap_parse_result
ldap_err2string
gpgkeys: unable to retrieve LDAP base: Confidentiality required
gpg: keyserver internal error
gpg: keyserver send failed: Keyserver error

There's a lot more output since I'm running it in debug and verbose, but these seems like the only relevant part. I can post the rest if needed.

Thanks!

share|improve this question
1  
Do you get the same error if you just use ldaps:// instead of trying STARTTLS over port 389? – larsks Aug 5 '13 at 19:06
    
When I try ldaps://<server>:636 or ldaps://<servername> I get errors indicating that it doesn't trust the certificate because it is unsigned: TLS certificate verification: Error, unable to get local issuer certificate TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed (unable to get local issuer certificate). – WildVelociraptor Aug 5 '13 at 19:26
    
What version of OpenLDAP (and GPG) are you using, and what distribution are you using? – larsks Aug 5 '13 at 20:07
    
On my laptop running Mac OS, OpenLDAP 2.4.28, and gpg 2.0.19. OpenLDAP 2.4.28 on the server, which is running Ubuntu 12.04. – WildVelociraptor Aug 5 '13 at 20:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.