1

I'm currently in the process of setting up two sychronized OpenLDAP servers, access through starttls/ldaps. On the client/slave, I had problems with the TLS connection. I'm using the directory-based configuration, and olcTLSCACertificateFile: /etc/ssl/certs/root-ca.pem is set, root-ca.pem is readable for user ldap.

However, starttls and ldaps connection fail:

ldapwhoami -x -H ldap://192.168.56.201/ -ZZ
ldap_start_tls: Connect error (-11)
    additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed (unable to get local issuer certificate)

If I add a ldaprc file to the current directory with the following entry

TLS_CACERT /etc/ssl/certs/root-ca.pem

everthing works as expected.

So it seems the olcTLSCACertificateFile setting is being ignored, or could there be any other errors / misconfigurations I'm missing? OS is Suse Enterprise 11sp4, OpenLDAP version is 2.4.26

1 Answer 1

3

ldapwhoami is an LDAP client tool. It does not use the olcTLSCACertificateFile parameter. That is a server-side paramater for slapd.

You need to specify somewhere, that the client tools understand, that you trust the CA. This can be done (as you have done) in the ldaprc file, in the global /etc/ldap/ldap.conf file, by being overly permissive in your CA checking (TLS_REQCERT allow ...not recommended), or maybe the best option is to add your CA to be trusted by the system itself by doing this (on Debian at least, ymmv):

  1. Copy your (PEM-encoded) CA certificate to /usr/local/share/ca-certificates on the client machine.
  2. Run # update-ca-certificates
  3. This will update the /etc/ssl/certs/ca-certificates.crt collection of CAs, which should already be specified in your /etc/ldap/ldap.conf file and your CA will be trusted by ldapwhoami and other tools.
1
  • FIrst part of your answer solved my issue: I tried to check the slapd-configuration with client tools that do not use the olcTLS* parameters. The slapd-configuration was correct: After adding starttls=yes to the syncrepl entry, connections between consumer and producer are encrypted, no more certificate verification errors.
    – twobeers
    May 3, 2016 at 7:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .