We recently updated the CA certificates on our LDAP host. There are a couple of CentOS 5.x servers which don't seem to have any issues authenticating against the LDAP host, but there's one Centos 6.6 server that isn't able to. I don't know how the server was originally configured, and the system administrator didn't leave much in the way of documentation when he left. The ldapsearch client appears to work without any issues. When I run ldapsearch with maximally verbose debug output, I don't see any errors:

$ ldapsearch -h ldap.hostname.com -x -LLL -v -d 167 -s base -b "" 2>&1 | grep -i error

res_errno: 0, res_error: <>, res_matched: <>
res_errno: 0, res_error: <>, res_matched: <>

Here is the output from the openssl s_client utility:

$ openssl s_client -connect ldap.hostname.com:636 < /dev/null

depth=3 C = SE, O = AddTrust AB, OU = AddTrust External TTP Network, CN = AddTrust External CA Root
verify return:1
depth=2 C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust RSA Certification Authority
verify return:1
depth=1 C = US, ST = MI, L = Ann Arbor, O = Internet2, OU = InCommon, CN = InCommon RSA Server CA
verify return:1
depth=0 C = , postalCode = , ST = , L = , street = , O = , OU = , CN = ldap.hostname.com
verify return:1
Certificate chain
 0 s:/C=US/postalCode=/ST=/L=/street=/OU=/CN=ldap.hostname.com
   i:/C=US/ST=MI/L=Ann Arbor/O=Internet2/OU=InCommon/CN=InCommon RSA Server CA
 1 s:/C=US/ST=MI/L=Ann Arbor/O=Internet2/OU=InCommon/CN=InCommon RSA Server CA
   i:/C=US/ST=New Jersey/L=Jersey City/O=The USERTRUST Network/CN=USERTrust RSA Certification Authority
 2 s:/C=US/ST=New Jersey/L=Jersey City/O=The USERTRUST Network/CN=USERTrust RSA Certification Authority
   i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
 3 s:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
   i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
Server certificate
issuer=/C=US/ST=MI/L=Ann Arbor/O=Internet2/OU=InCommon/CN=InCommon RSA Server CA
No client certificate CA names sent
SSL handshake has read 5715 bytes and written 607 bytes
New, TLSv1/SSLv3, Cipher is AES256-SHA256
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
    Protocol  : TLSv1.2
    Cipher    : AES256-SHA256
    Session-ID: [...]
    Master-Key: [...]
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    Start Time: [...]
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)

When I run nslcd in debug mode, I find the following errors:

$ sudo nslcd -d -d -d 2>&1 > nslcd.log

$ cat nslcd.log | grep -i error

res_errno: 0, res_error: <>, res_matched: <>

TLS: cannot open certdb '/etc/openldap/cacerts', error -8018:Unknown PKCS #11 error.

TLS: certificate [...] is not valid - error -8172:Peer's certificate issuer has been marked as not trusted by the user..

TLS: error: connect - force handshake failure: errno 0 - moznss error -8172

TLS: can't connect: TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user..

nslcd: [8b4567] ldap_start_tls_s() failed: Connect error (uri="ldap://ldap.hostname.com/")

nslcd: [8b4567] failed to bind to LDAP server ldap://ldap.hostname.com/: Connect error

res_errno: 0, res_error: <>, res_matched: <>


Here are the contents of /etc/ldap.conf:

base o=org
timelimit 120
bind_timelimit 120
idle_timelimit 3600
nss_initgroups_ignoreusers root,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman,nscd,gdm
nss_map_attribute uniqueMember member
nss_base_passwd ou=People,?one
nss_base_group ou=Group,?one
uri ldap://ldap.hostname.com
ssl start_tls
TLS_CACERTDIR /etc/openldap/certs
pam_password md5

Here are the contents of /etc/openldap/ldap.conf:

TLS_CACERTDIR /etc/openldap/certs
URI ldap://ldap.hostname.com/
BASE o=org

And here are the contents of /etc/nslcd.conf:

uid nslcd
gid ldap
uri ldap://ldap.hostname.com/
base o=org
ssl start_tls
tls_cacertdir /etc/openldap/cacerts
tls_cacertfile /etc/openldap/cacerts/authconfig_downloaded.pem

I've googled the error messages, but I'm more than a little overwhelmed by all the different LDAP documentation that I've found online. Any advice would be greatly appreciated.

1 Answer 1


for rhel and derivatives since version 6 you use update-ca-trust (man 8 update-ca-trust for all the details). Lots of info in https://www.happyassassin.net/2015/01/14/trusting-additional-cas-in-fedora-rhel-centos-dont-append-to-etcpkitlscertsca-bundle-crt-or-etcpkitlscert-pem/

Basically you put your ca file in PEM format in /etc/pki/ca-trust/source/anchors/ and run as root update-ca-trust; if it's in the extended trusted certificate format, then you should place it in /etc/pki/ca-trust/source and again, update-ca-trust.

o, and in centos 6 running nslcd is discouraged. sssd does a much better work at caching info, among other things.

  • No dice. Could I be doing something wrong?
    – igal
    Jun 22, 2015 at 20:56
  • without looking at your CA file and testing your ldap server with openssl I could not tell you. Please post the results of openssl s_client -connect ldap.host.tld:636 (obfuscate as needed) Jun 23, 2015 at 12:40
  • I've added the s_client output near the top of my post.
    – igal
    Jun 23, 2015 at 18:54
  • Verify return code: 0 (ok) means your CA is known to openssl so that is positive. Jun 23, 2015 at 20:04
  • I found this: server-world.info/en/note?os=CentOS_6&p=ldap&f=3, could you verify the steps for the client: /etc/openldap/ldap.conf, /etc/nslcd.conf, /etc/pam_ldap.conf plus authconfig --enableldaptls --update ? Also, if that does not work, could you take a look at onemoretech.wordpress.com/2014/02/23/… using sssd instead of nslcd? I do not have recent experience with plain ldap, but sssd with AD or IPA is really really nice and simple Jun 23, 2015 at 20:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .