I'm trying to enable SSL connections on an OpenLDAP 2.4.23 server, but all the instructions I find only discuss the old slapd.conf configuration. Can anyone point to some instructions for setting it up under cn=config?


Here's whats working so far, though I could still use a guide to tuning the security settings under cn=config:

Follow the instructions here to create the certificate, added the tls attributes to cn=config (last two were set by default)

olcTLSCertificateFile /certs/ldapscert.pem
olcTLSCertificateKeyFile /certs/keys/ldapskey.pem
olcTLSCipherSuite TLSV1+RSA:!NULL
olcTLSCRLCheck none
olcTLSVerifyClient never

start server using /usr/local/libexec/slapd -F slapd.d -h ldaps:///

This lets me connect from Apache Directory Studio using ldaps, but isn't working for linux logins.

  • 1
    Had to generate a certificate with alt-subject-names for both ldap servers and the meta-server name and distribute the certs to all the other linux servers to get linux logins working securely. – Brad Mace Feb 7 '11 at 21:00

If, like me, you found this answer but were looking for the dynamic config (cn=config) option, use the following ldif.

dn: cn=config
changetype: modify
replace: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /path/to/host.key
replace: olcTLSCertificateFile
olcTLSCertificateFile: /path/to/host.crt
replace: olcTLSCACertificatePath
olcTLSCACertificatePath: /etc/ssl/cert

To add the ldif use:

sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f nameOfLdif.ldif
  • When I use what @Andrew Meyer suggested in my HA setup I get the following error: ldap_modify: Other (e.g., implementation specific) error (80) – Digital Human May 7 at 9:22

So it seems that in HA setup you can not use NSS db if you need to update your TLS certificate name. Its not possible to update the name through LDIF with ldapmodify.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.