Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using CentOS 5.I have a problem enabling TLS (or ssl) on OpenLDAP server. I followed this tutorial. I generated the certificates and I configured the path in slapd.conf as following

TLSCertificateFile      /path/to/server-certificate.pem
TLSCertificateKeyFile   /path/to/private-key.pem
TLSCACertificateFile    /path/to/CA-certificates

I used the command

slapd -h "ldap:/// ldaps:///"

to enable listener on port 636.

I can't create a connection to ldaps://myhost:636 (I tried to create a connection with a client and liferay ldap)

I haven't problems if I not use TLS.

Did I miss some steps in configuration here?

Edit

using the command:

openssl s_client -connect host:port

I obtain

enter image description here

share|improve this question
1  
Use the openssl command to see what exactly goes wrong. Like so: openssl s_client -connect host:port. – Tim Lamballais Sep 16 '13 at 12:23
    
Also check using netstat or lsof if your slapd is really listening on 636. – vautee Sep 16 '13 at 12:25

Most likely you have problem with your CA certificate. You can check TLS connection from the serer using:

$ ldapwhoami -H ldap:// -x -ZZ
anonymous

Check your /etc/ldap/ldap.conf for this line:

TLS_CACERT /etc/ssl/certs/ca_server.pem

Best way how to modify LDAP configuration is creating addcerts.ldif with following content:

dn: cn=config
changetype: modify
add: olcTLSCACertificateFile
olcTLSCACertificateFile: /etc/ssl/certs/ca_server.pem
-
add: olcTLSCertificateFile
olcTLSCertificateFile: /etc/ssl/certs/ldap_server.pem
-
add: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/ssl/private/ldap_server.key

and apply change:

ldapmodify -H ldapi:// -Y EXTERNAL -f addcerts.ldif

Lastly check /etc/default/slapd and make sure services contains ldaps:///:

SLAPD_SERVICES="ldap:/// ldapi:/// ldaps:///"

Afterwards just reload slapd service and check connection to LDAP using the first command.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.