21

When trying to make ldaps connections to my Novel eDirectory 8.8 server, sometimes I have to put TLS_REQCERT never in the client servers ldap.conf file. Obviously, this is a bad idea.

The command I run is something like this with credentials that actually work...

ldapsearch -x -H ldaps://ldapserver -b 'ou=active,ou=people,dc=example,dc=org' -D 'cn=admin,dc=example,dc=org' -W "cn=username"

On Ubuntu 13.10, it works fine.

On SLES it works fine.

On CentOS 6.5 it returns:

ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)

Now, the cert I've imported is a wildcard cert purchased from DigiCert. My coworker found some reports indicating that some systems have issues with wildcards.

So, is the wildcard cert to blame? If so, how do I fix it?

If it is not the wildcard cert, then what is it?

Following Andrew Schulman's suggestion, I added -d1 to my ldapsearch command. Here is what I ended up with:

ldap_url_parse_ext(ldaps://ldap.example.org)
ldap_create
ldap_url_parse_ext(ldaps://ldap.example.org:636/??base)
Enter LDAP Password: 
ldap_sasl_bind
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP ldap.example.org:636
ldap_new_socket: 3
ldap_prepare_socket: 3
ldap_connect_to_host: Trying 10.225.0.24:636
ldap_pvt_connect: fd: 3 tm: -1 async: 0
TLS: certdb config: configDir='/etc/openldap' tokenDescription='ldap(0)' certPrefix='cacerts' keyPrefix='cacerts' flags=readOnly
TLS: cannot open certdb '/etc/openldap', error -8018:Unknown PKCS #11 error.
TLS: could not get info about the CA certificate directory /etc/openldap/cacerts - error -5950:File not found.
TLS: certificate [CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US] is not valid - error -8172:Peer's certificate issuer has been marked as not trusted by the user..
TLS: error: connect - force handshake failure: errno 2 - moznss error -8172
TLS: can't connect: TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user..
ldap_err2string
ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)

From what that says, CentOS doesn't trust DigiCert? Or CentOS doesn't have a list of trusted issuers?

Improve this question
6
  • 1
    "Can't contact LDAP server" sounds more like the server is simply not reachable from that client machine. Have you checked first that you can in fact connect to it? E.g. telnet ldapserver ldaps or openssl s_client -connect ldapserver:636.
    – Richard E. Silverman
    Commented Mar 1, 2014 at 6:54
  • Yes, I have confirmed that it can connect to the server. After all, it would never work at all if it couldn't connect at all.
    – David R.
    Commented Mar 1, 2014 at 18:45
  • You mentioned three different client hosts. The one which is not working might have been unable to connect due to a networking issue while the others could.
    – Richard E. Silverman
    Commented Mar 1, 2014 at 22:03
  • I thought my post was pretty clear that I was editing the ldap.conf file on all hosts. As in when I added the line to file, it worked, but without the line it didn't. Thus, not a connection issue.
    – David R.
    Commented Mar 4, 2014 at 21:39
  • That was not clear to me when I read your post initially, though I see what you mean now. Anyway, the TLS debugging info you've added shows the problem; I've added an answer to follow up.
    – Richard E. Silverman
    Commented Mar 5, 2014 at 2:57

3 Answers 3

Reset to default
13

ldapsearch is looking in /etc/openldap/cacerts for its store of trusted CA certificates, and that apparently is not set up, and thus it is rejecting the certificate since it can't construct a trust chain for it. If ldapsearch were using OpenSSL, it would need a "hashdir" format collection as produced by e.g. the Red Hat "authconfig" program, or a single file with a flat list of trusted certificates. The reference here to "moznss" suggests that this ldapsearch is built against Mozilla NSS, in which case you need to use "certutil" to make the cert db (or better, point it at the system NSS certificate store, if there is one).

On the systems where it's working ldapsearch must have a working certificate store, perhaps because those OpenLDAP packages are built against OpenSSL instead (or maybe there's a working NSS-style store available there).

Improve this answer
2
  • 3
    Ah. /etc/openldap/certs is where the cert store is. Not cacerts. In /etc/openldap/ldap.conf I changed TLS_CACERTDIR /etc/openldap/cacerts to TLS_CACERTDIR /etc/openldap/certs and my ldapsearch command started working. Thanks!
    – David R.
    Commented Mar 5, 2014 at 17:20
  • I have ldapsearch installed on Ubuntu 16.04, and there's no /etc/openldap directory.
    – vcardillo
    Commented May 23, 2017 at 19:40
19

ldapsearch will say "Can't contact LDAP server" if it can't verify the TLS certificate. Add -d1 to your ldapsearch command, and check the output lines that begin with "TLS:" to get more information about whether the TLS connection is failing and why.

Improve this answer
1
  • I edited my question in response to your suggestion. Thanks!
    – David R.
    Commented Mar 4, 2014 at 21:38
15

Solution depends on your installation:

  • If you are using a non valid cert, you can force accept it configuring /etc/openldap/ldap.conf with

    TLS_REQCERT allow

    or

    TLS_REQCERT never

  • If you are using a valid cert probably your ldap instalation don't know where store of trusted CA certificates is (probably depending on your OpenSSL installation). Then you can try to set it location and force check configuring /etc/openldap/ldap.conf with

    TLS_CACERT /etc/openldap/cacert
TLS_REQCERT demand

    /etc/openldap/cacert can be this or be located in any path. It must contain certificate chain of your CA. It can be a single file with a flat list of trusted certificates.

Note paths depends on ldap provider. It could be /etc/ldap or /etc/openldap or so.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .