2

I've set up an Active Directory server and configured LDAP-over-SSL, which works fine for machines on the domain, however because it's using certificates provisioned by AD's Certificate Services it causes issues elsewhere.

I'm trying to connect to the LDAP-over-SSL port from a Debian box using openssl s_client, and I'm getting this error:

Verify return code: 21 (unable to verify the first certificate)

I've added my new root CA certificate to /usr/share/ca-certificates/extra/my-new-root-ca.crt and run update-ca-certificates, and using this command works:

openssl s_client -CAfile /usr/share/ca-certificates/extra/my-new-root-ca.crt -showcerts -connect my.domain.com:636

Whereas this:

openssl s_client -showcerts -connect my.domain.com:636

nets me these errors at the top of the output:

depth=0
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0
verify error:num=27:certificate not trusted
verify return:1
depth=0
verify error:num=21:unable to verify the first certificate
verify return:1

Also, this command:

ldapsearch -d8 -x -LLL -H ldaps://my.domain.com -D cn=username -w password -b "dc=my,dc=domain,dc=com" -s sub "(objectClass=user)" givenName

nets me this output:

TLS: can't connect: (unknown error code).
ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)

So, it looks like neither openssl s_client nor ldapsearch are picking up the certificate from /etc/ssl/certs/ca-certificates.crt. Is it actually possible to get openssl to accept my certificate?

2
  • OpenSSL might not be using the trust file that was generated for the system - what about if you point the -CAfile at /etc/ssl/cert/ca-certificates.crt? (and verify that your cert was added to that file) Nov 24, 2014 at 0:28
  • It looks like that's the case. Using /etc/ssl/certs/ca-certificates.crt works fine, so it isn't automatically picking up the trusted certificates. Is it supposed to do this automatically, or am I assuming that it does and I just needed to verify that the certificate was in the ca-certificates.crt file? Nov 24, 2014 at 0:48

1 Answer 1

2

OpenSSL can be a bit.. twitchy.. about what certificates it trusts - sometimes it won't use the system's trusted certificate store. Adjust its config in the openssl.cnf if you're so inclined to make it trust the right store.

For ldapsearch, same kind of deal - you'll want to set the trusted certificate in ldap.conf to make it actually use the trusted certificate, the option for that is TLS_CACERT.

1
  • TLS_CACERT did it. /etc/ldap/ldap.conf was missing, so I looked up a basic config (apparently just base and uri are enough), then slapped in TLS_CACERT and the ldapsearch error vanished. Woo! Cheers. :) Nov 24, 2014 at 15:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .