I'm currently in the process of setting up two sychronized OpenLDAP servers, access through starttls/ldaps. On the client/slave, I had problems with the TLS connection. I'm using the directory-based configuration, and olcTLSCACertificateFile: /etc/ssl/certs/root-ca.pem
is set, root-ca.pem
is readable for user ldap
.
However, starttls and ldaps connection fail:
ldapwhoami -x -H ldap://192.168.56.201/ -ZZ
ldap_start_tls: Connect error (-11)
additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed (unable to get local issuer certificate)
If I add a ldaprc
file to the current directory with the following entry
TLS_CACERT /etc/ssl/certs/root-ca.pem
everthing works as expected.
So it seems the olcTLSCACertificateFile
setting is being ignored, or could there be any other errors / misconfigurations I'm missing? OS is Suse Enterprise 11sp4, OpenLDAP version is 2.4.26