I'm having a hard time migrating our openldap installation from Debian to RedHat.

Two instances of openldap are running, they have the same configuration, except that one handles ldap: requests, and the other one ldaps: requests.

netstat shows that they are both listening:

sudo netstat -avp --tcp | grep ldap
tcp        0      0 *:ldap                      *:*                         LISTEN      11348/slapd
tcp        0      0 vldap-test-1.ceti.etat-:ssh         ESTABLISHED 10461/sshd
tcp        0      0 vldap-test-1.ceti.etat-:ssh         ESTABLISHED 7993/sshd
tcp        0     64 vldap-test-1.ceti.etat-:ssh         ESTABLISHED 10281/sshd
tcp        0      0 *:ldaps                     *:*                         LISTEN      11344/slapd
tcp        0      0 *:ldap                      *:*                         LISTEN      11348/slapd

I'm not sure why two lines are shown for ldap, and only one for ldaps... whatever...

The ldap: requests work fine, but the ldaps: requests don't.

What's more puzzling, is that when I type the following command:

sudo openssl s_client -connect vldap-test-1:636 -showcerts

Or, with the IP address:

sudo openssl s_client -connect -showcerts

I'm getting:

socket: Connection refused

whereas when I use localhost (not

sudo openssl s_client -connect localhost:636 -showcerts

I'm getting:

depth=0 CN = vldap-test, OU = DGSI, O = Etat, L = GE, ST = GE, C = CH
verify error:num=18:self signed certificate
verify return:1
depth=0 CN = vldap-test, OU = DGSI, O = Etat, L = GE, ST = GE, C = CH
verify return:1
Certificate chain
 0 s:/CN=vldap-test/OU=DGSI/O=Etat/L=GE/ST=GE/C=CH
... etc...

Can anyone help me understand what's happening here?

Thanks in advance


It seems that the ldap: instance is listening both IPv6 and IPv4 but the ldaps: version is listening only IPv6.

How can I fix this?

  • First thought with an error message: Connection refused is a firewall blocking the connection. – HBruijn Dec 11 '14 at 13:43
  • I doubt it: I'm running these commands on the server itself. Oh, BTW, there is nothing in the IP tables. – Maurice Perry Dec 11 '14 at 13:46

Got it: the IPv4 port was attributed to portreserve.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.