I am trying to use ldap with ssl on Server 2008 R2. Got it all set and am able to connect using ldp.exe to the domain.example.org port 636 with the ssl checkbox. This is on the local server itself.

However - I am unable to connect using ldapsearch using ssl and port 636. No ssl and port 389 works fine using ldapsearch.

Any ideas? Do my clients need to have a certificate installed or something? I mostly just wanted to have ldap connections encrypted. Thanks for any help!

* Edit *

The command that works:

ldapsearch -x -b "dc=XX,dc=example,dc=org" -D "user@example.org" -H ldap://XX.example.org -W '(&(proxyAddresses=smtp*)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))'

The command that doesn't work:

ldapsearch -x -b "dc=XX,dc=example,dc=org" -D "user@example.org" -H ldaps://XX.example.org:636 -W '(&(proxyAddresses=smtp*)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))'

I have tried variations of -h and using the -p to specify the port.

How would I go about installing the certificate from the server 2008 onto the client?

  • What is the ldapsearch command you are running? You will need a cert, otherwise it cannot guarantee who you are to negotiate the encrypted channel – TheFiddlerWins Aug 22 '13 at 15:03
  • I updated the question with the info you mentioned. Any ideas on how to add the cert to the client machine? – user1453561 Aug 22 '13 at 15:48
  • 1
    what was the error message? – strongline Oct 29 '15 at 18:22

Your clients don't need their own certificate. They just need to trust the Certificate Authority certificate (or certificate chain) that signed the LDAP server's certificate. You didn't need to worry about this on the localhost because the CA certificate was already trusted by default.

It's not clear from your question whether the LDAP server is also the Certificate Authority and whether it is using the CA certificate as the LDAP certificate as well. Normally, these are two different certificates and the Certificate Authority lives on a different machine.

Some quick google'ing indicates there's an option you can set in the ldap.conf called TLS_CACERT or an equivalent environment variable called LDAPTLS_CACERT that you can point to a file containing any/all CA certificates in your environment (base64 encoded).

If you only have a single CA in your environment, you should be able to download a base64 encoded version of its public certificate. And if you can only find a DER encoded version, you can use openssl to convert it to base64.

openssl x509 -inform der -in cacert.crt -out cacert.pem

Sadly, his is expected behavior. LDAP is just weird that way, at least for Windows AD. There is no such thing as ldaps, but if you specify the port number encryption will happen. Try this command:

ldapsearch -x -b "dc=XX,dc=XXX,dc=org" -D "user@XXX.org" -H ldap://XX.XXX.org:636 -W '(&(proxyAddresses=smtp*)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))'

For most anything other than LDAP it looks like you're asking for plain-text traffic on the service's default port for SSL. LDAP will do encrypted traffic here.

I don't like it either, because it makes it extra difficult to verify that encryption is happening. With a port change, maybe it's just sending plain-text over the encrypted port, but with an explicit schema/protocol you can know it's at least trying. Explicit protocol schemas also make it easier to run things on non-standard ports when you need to. But like it or not, this is the way it is.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.