So i have set up an openldap server using this guide here. It worked fine. But as i want to use sssd i also need TLS to be working for ldap. So i looked into and followed the TLS part of the guide.

And i never got any errors and slapd started fine again.

BUT. It does not seem to work when i try to use ldap over tls.

root@server:~# ldapsearch -x -ZZ -H ldap:// -b dc=daladevelop,dc=se
ldap_start_tls: Protocol error (2)
    additional info: unsupported extended operation

Ganking up the debug level some notches returns some more information:

root@server:~# ldapsearch -x -ZZ -H ldap:// -b dc=daladevelop,dc=se -d 5
ldap_new_connection 1 1 0
ldap_connect_to_host: TCP
ldap_new_socket: 3
ldap_prepare_socket: 3
ldap_connect_to_host: Trying
ldap_pvt_connect: fd: 3 tm: -1 async: 0
ldap_open_defconn: successful
ber_scanf fmt ({it) ber:
ber_scanf fmt ({) ber:
ber_flush2: 31 bytes to sd 3
ldap_result ld 0x7f25df51e220 msgid 1
wait4msg ld 0x7f25df51e220 msgid 1 (infinite timeout)
wait4msg continue ld 0x7f25df51e220 msgid 1 all 1
** ld 0x7f25df51e220 Connections:
* host:  port: 389  (default)
  refcnt: 2  status: Connected
  last used: Fri Jun  6 08:52:16 2014

** ld 0x7f25df51e220 Outstanding Requests:
 * msgid 1,  origid 1, status InProgress
   outstanding referrals 0, parent count 0
  ld 0x7f25df51e220 request count 1 (abandoned 0)
** ld 0x7f25df51e220 Response Queue:
  ld 0x7f25df51e220 response count 0
ldap_chkResponseList ld 0x7f25df51e220 msgid 1 all 1
ldap_chkResponseList returns ld 0x7f25df51e220 NULL
read1msg: ld 0x7f25df51e220 msgid 1 all 1
ber_get_next: tag 0x30 len 42 contents:
read1msg: ld 0x7f25df51e220 msgid 1 message type extended-result
ber_scanf fmt ({eAA) ber:
read1msg: ld 0x7f25df51e220 0 new referrals
read1msg:  mark request completed, ld 0x7f25df51e220 msgid 1
request done: ld 0x7f25df51e220 msgid 1
res_errno: 2, res_error: <unsupported extended operation>, res_matched: <>
ldap_free_request (origid 1, msgid 1)
ber_scanf fmt ({eAA) ber:
ber_scanf fmt ({iAA) ber:
ber_scanf fmt (}) ber:
ldap_start_tls: Protocol error (2)
        additional info: unsupported extended operation
ldap_free_connection 1 1
ber_flush2: 7 bytes to sd 3
ldap_free_connection: actually freed

So no good information there neither.

In /var/log/syslog i get:

Jun  6 08:55:42 master slapd[21383]: conn=1008 fd=23 ACCEPT from IP= (IP=
Jun  6 08:55:42 master slapd[21383]: conn=1008 op=0 EXT oid=
Jun  6 08:55:42 master slapd[21383]: conn=1008 op=0 do_extended: unsupported operation ""
Jun  6 08:55:42 master slapd[21383]: conn=1008 op=0 RESULT tag=120 err=2 text=unsupported extended operation
Jun  6 08:55:42 master slapd[21383]: conn=1008 op=1 UNBIND
Jun  6 08:55:42 master slapd[21383]: conn=1008 fd=23 closed

If i portscan the host i get the following:

Starting Nmap 6.40 ( http://nmap.org ) at 2014-06-06 08:56 CEST
Nmap scan report for h83-209-243-253.static.se.alltele.net (
Host is up (0.0072s latency).
Not shown: 996 closed ports
22/tcp  open  ssh
80/tcp  open  http
389/tcp open  ldap
636/tcp open  ldapssl

But when i check certs

root@master:~# openssl s_client -connect daladevelop.se:636 -showcerts -state
SSL_connect:before/connect initialization
SSL_connect:unknown state
140244859233952:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:177:
no peer certificate available
No client certificate CA names sent
SSL handshake has read 0 bytes and written 317 bytes
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE

And i feel like i am clearly out in deep water not knowing at all where to go from here. Anny hints appreciated on what to do or to get better debug logging...

EDIT: This is my config slapcated from cn=config and it does not mention at all anything about TLS.

I have inserted my certinfo.ldif:

root@master:~# cat certinfo.ldif 
dn: cn=config

add: olcTLSCACertificateFile
olcTLSCACertificateFile: /etc/ssl/certs/cacert.pem
add: olcTLSCertificateFile
olcTLSCertificateFile: /etc/ssl/certs/daladevelop_slapd_cert.pem
add: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/ssl/private/daladevelop_slapd_key.pem

and when doing that i only got this as an answer.

root@master:~# sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f certinfo.ldif 
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
modifying entry "cn=config"

So still no wiser.

  • Everything you have posted demonstrates that the SSL part of your configuration is working correctly. Otherwise you could not possibly get LDAP-specific error codes returned by the server. Your question remains unclear. – user207421 Jun 7 '14 at 23:20

I found the solution over at Persuading openldap to work with SSL on Ubuntu with cn=config

which links to: http://rogermoffatt.com/2011/08/24/ubuntu-openldap-with-ssltls/ that has the complete solution.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.