I'm running OpenLDAP on an up-to-date Debian box. I'm trying to run a simple command:

ldapsearch -x -h <<IP>>:636 -D cn=<<BASE DN>> -d1 and I get this output:

ldap_new_connection 1 1 0
ldap_connect_to_host: TCP <<IP>>:636
ldap_new_socket: 3
ldap_prepare_socket: 3
ldap_connect_to_host: Trying <<IP>>:636
ldap_pvt_connect: fd: 3 tm: -1 async: 0
ldap_open_defconn: successful
ber_scanf fmt ({it) ber:
ber_scanf fmt ({i) ber:
ber_flush2: 35 bytes to sd 3
ldap_result ld 0x7f962cf14460 msgid 1
wait4msg ld 0x7f962cf14460 msgid 1 (infinite timeout)
wait4msg continue ld 0x7f962cf14460 msgid 1 all 1
** ld 0x7f962cf14460 Connections:
* host: <<IP>>  port: 636  (default)
  refcnt: 2  status: Connected
  last used: Wed Dec 17 13:48:09 2014

** ld 0x7f962cf14460 Outstanding Requests:
 * msgid 1,  origid 1, status InProgress
   outstanding referrals 0, parent count 0
  ld 0x7f962cf14460 request count 1 (abandoned 0)
** ld 0x7f962cf14460 Response Queue:
  ld 0x7f962cf14460 response count 0
ldap_chkResponseList ld 0x7f962cf14460 msgid 1 all 1
ldap_chkResponseList returns ld 0x7f962cf14460 NULL
read1msg: ld 0x7f962cf14460 msgid 1 all 1
ldap_result: Can't contact LDAP server (-1)
ldap_free_request (origid 1, msgid 1)
ldap_free_connection 1 1
ldap_free_connection: actually freed

I'm at a loss as to what that actually means. It appears that everything goes fine, but then it craps the bed when trying to retrieve the results. Is there anything in that output which tells can lead me to figuring out why my search isn't working?

When I run the same query without specifying the secure port, my search works fine:

ldapsearch -x -h <<IP>> -D cn=<<BASE DN>>


Rather than specifying the SSL port after the IP address, use the ldaps protocol in the URI with the -H switch.

ldapsearch -x -H ldaps:// -D cn=[base DN] -d1

If you are connecting to a server with a self-signed certificate, you may also need to modify ldap.conf to disable certificate verification:

PORT 636
  • When I do that, I get an error - something about how the host isn't a suitable format. In the error message, it appears that the "//" gets converted to a URL save encoding. I'll comment again tomorrow when I'm back at work and can see the error. – Quasipickle Dec 18 '14 at 1:11
  • Did you use the capital "H"? This option should take a full URI whereas lowercase "h" expects only a hostname. – dartonw Dec 18 '14 at 1:48
  • doing what you said gives me different output, but the most telling line is: TLS: peer cert untrusted or revoked (0x42). So somehow I need to get the public key of the cert I'm connecting to, and add that to my certs. (Not verifying the certificate is not an option - as that pretty much completely negates the reason for using ldaps in the first place). Thanks for your help. – Quasipickle Dec 18 '14 at 15:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.