I've set up an Active Directory server and configured LDAP-over-SSL, which works fine for machines on the domain, however because it's using certificates provisioned by AD's Certificate Services it causes issues elsewhere.
I'm trying to connect to the LDAP-over-SSL port from a Debian box using openssl s_client
, and I'm getting this error:
Verify return code: 21 (unable to verify the first certificate)
I've added my new root CA certificate to /usr/share/ca-certificates/extra/my-new-root-ca.crt
and run update-ca-certificates
, and using this command works:
openssl s_client -CAfile /usr/share/ca-certificates/extra/my-new-root-ca.crt -showcerts -connect my.domain.com:636
Whereas this:
openssl s_client -showcerts -connect my.domain.com:636
nets me these errors at the top of the output:
depth=0
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0
verify error:num=27:certificate not trusted
verify return:1
depth=0
verify error:num=21:unable to verify the first certificate
verify return:1
Also, this command:
ldapsearch -d8 -x -LLL -H ldaps://my.domain.com -D cn=username -w password -b "dc=my,dc=domain,dc=com" -s sub "(objectClass=user)" givenName
nets me this output:
TLS: can't connect: (unknown error code).
ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)
So, it looks like neither openssl s_client
nor ldapsearch
are picking up the certificate from /etc/ssl/certs/ca-certificates.crt
. Is it actually possible to get openssl to accept my certificate?
-CAfile
at/etc/ssl/cert/ca-certificates.crt
? (and verify that your cert was added to that file)