Has anybody got SSL client authentication working with OpenLDAP (on CentOS7 - which is using moznss)?
I've search for the last 2 days trying to get this to work, both with a certutil database and straight PEM configuration, and frustrated that it is not working.
My initial though is the client is not sending the SSL certificate for validation, and I have proved this when using PEM authentication and strace (and there is no open() on the crt file or key).
First, this is RHEL7, and both client and server have the same version of openldap installed:
Server:
openldap-servers-2.4.39-6.el7.x86_64
openldap-2.4.39-6.el7.x86_64
Client:
openldap-clients-2.4.39-6.el7.x86_64
openldap-2.4.39-6.el7.x86_64
SSL: My own CA.
Using PEM authentication:
Server (cn=config.ldif):
olcTLSCACertificateFile: /etc/openldap/tls/ldap-ca.crts
olcTLSCertificateFile: /etc/openldap/tls/ldap-server.crt
olcTLSCertificateKeyFile: /etc/openldap/tls/ldap-server.key
olcTLSVerifyClient: hard
Server (/usr/sbin/slapd -u ldap -h "ldapi:/// ldap:/// ldaps:///" -d 1):
55935ff8 slap_listener_activate(10):
55935ff8 >>> slap_listener(ldaps:///)
55935ff8 connection_get(18): got connid=1000
55935ff8 connection_read(18): checking for input on id=1000
TLS: loaded CA certificate file /etc/openldap/tls/ldap-ca.crts.
TLS: error: the certificate '/etc/openldap/tls/ldap-server.crt' could not be found in the database - error -12285:Unable to find the certificate or key necessary for authentication..
TLS: certificate '/etc/openldap/tls/ldap-server.crt' successfully loaded from PEM file.
TLS: no unlocked certificate for certificate 'CN=x.x.x,...,C=AU'.
TLS: certificate [CN=x.x.x,...,C=AU] is valid
55935ff8 connection_get(18): got connid=1000
55935ff8 connection_read(18): checking for input on id=1000
TLS: error: accept - force handshake failure: errno 11 - moznss error -12285
TLS: can't accept: TLS error -12285:Unable to find the certificate or key necessary for authentication..
55935ff8 connection_read(18): TLS accept failure error=-1 id=1000, closing
55935ff8 connection_close: conn=1000 sd=18
Client (/etc/openldap/ldap.conf):
TLS_CACERT /etc/openldap/tls/ldap-ca.crts
TLS_CERT /etc/openldap/tls/ldap-client.crt
TLS_KEY /etc/openldap/tls/ldap-client.key
TLS_REQCERT never
Client (ldapsearch -d1 -H ldaps://x.x.x -b c=AU 'uid=x'):
TLS: loaded CA certificate file /etc/openldap/tls/ldap-ca.crts.
TLS: certificate [CN=x.x.x,...,C=AU] is valid
TLS: error: connect - force handshake failure: errno 21 - moznss error -12271
TLS: can't connect: TLS error -12271:SSL peer cannot verify your certificate..
Client (strace - no presentation of client certificate)
...
8047 stat("/etc/openldap/tls/ldap-ca.crts", {st_mode=S_IFREG|0644, st_size=5287, ...}) = 0
8047 open("/etc/openldap/tls/ldap-ca.crts", O_RDONLY) = 4
...
Client connection just using openssl connect works fine:
openssl s_client -connect x.x.x:636 -showcerts -CAfile /etc/openldap/tls/ldap-ca.crts -key /etc/openldap/tls/ldap-client.key -state -cert /etc/openldap/tls/ldap-client.crt
...
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES128-SHA
Server public key is 1024 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES128-SHA
Session-ID: [long hex value]
Session-ID-ctx:
Master-Key: [long hex value]
Key-Arg : None
Krb5 Principal: None
PSK identity: None
PSK identity hint: None
Start Time: 1435722028
Timeout : 300 (sec)
Verify return code: 0 (ok)
Using certutil (moznss database):
Same problem:
Server (cn=config.ldif):
olcTLSVerifyClient: hard
olcTLSCertificateFile: "x.x.x - X"
olcTLSCACertificatePath: /etc/openldap/certs
Server (moznss):
[root@host certs]# certutil -d . -L
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
x LDAP CA CT,C,C
x.x.x - X u,u,u
x CA CT,C,C
x CA CT,C,C
Server (/usr/sbin/slapd -u ldap -h "ldapi:/// ldap:/// ldaps:///" -d 1):
559363d2 connection_get(18): got connid=1000
559363d2 connection_read(18): checking for input on id=1000
TLS: certdb config: configDir='/etc/openldap/certs' tokenDescription='ldap(0)' certPrefix='' keyPrefix='' flags=readOnly
TLS: using moznss security dir /etc/openldap/certs prefix .
TLS: certificate 'x.x.x - X' successfully loaded from moznss database.
TLS: no unlocked certificate for certificate 'CN=x.x.x,...,C=AU'.
TLS: certificate [CN=x.x.x,...,C=AU] is valid
559363d2 connection_get(18): got connid=1000
559363d2 connection_read(18): checking for input on id=1000
TLS: error: accept - force handshake failure: errno 11 - moznss error -12285
TLS: can't accept: TLS error -12285:Unable to find the certificate or key necessary for authentication..
Client (/etc/openldap/ldap.conf):
TLS_CACERTDIR /etc/openldap/certs
TLS_CERT "x - X"
TLS_REQCERT never
Client (moznss):
[root@client certs]# certutil -d . -L
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
X LDAP CA CT,C,C
x - X u,u,u
X Root CA CT,C,C
X CA CT,,
Client (ldapsearch -d1 -H ldaps://x.x.x -b c=AU 'uid=x'):
TLS: certdb config: configDir='/etc/openldap/certs' tokenDescription='ldap(0)' certPrefix='' keyPrefix='' flags=readOnly
TLS: using moznss security dir /etc/openldap/certs prefix .
TLS: certificate [CN=x.x.x,...,C=AU] is valid
TLS: error: connect - force handshake failure: errno 21 - moznss error -12271
TLS: can't connect: TLS error -12271:SSL peer cannot verify your certificate..
Using this method openssl test works fine, however, ldapsearch fails with the same error. strace doesnt help, but does show opening the database files for the certificates.
Client (strace):
8075 stat("/etc/openldap/certs/cert8.db", {st_mode=S_IFREG|0644, st_size=65536, ...}) = 0
8075 open("/etc/openldap/certs/cert8.db", O_RDONLY) = 4
8075 stat("/etc/openldap/certs/key3.db", {st_mode=S_IFREG|0644, st_size=16384, ...}) = 0
8075 open("/etc/openldap/certs/key3.db", O_RDONLY) = 5
Anybody got any hints? (frustrated - I know I had this working on older versions of CentOS)