4

I've used to use the following command to download my server SSL certs from LDAP in order to add them to tomcat/java keystores:

openssl s_client -connect 10.140.136.192:636

Since LDAP SSL (port 636) has been deprecated, I don't have port 636 available anymore. I've tried to find various incantations for openssl s_client such as -starttls and -tls1_2 however none of them produce the certificate. What is the magic word to do this?

2

OpenSSL supports starttls for a number of protocols with s_client:

-starttls protocol
send the protocol-specific message(s) to switch to TLS for communication. protocol is a keyword for the intended protocol. Currently, the only supported keywords are "smtp", "pop3", "imap", and "ftp".

which would allow you to easily retrieve the public certificate but LDAP isn't one them, unfortunately.

Since the upgrade to TLS is protocol specific you need a tool that understands the protocol. That rules out OpenSSL.

I don't have a directory at hand but wouldn't the verbose ldapsearch -Z -v -H ldap://ldap.example.com:389 ... display the certificate as part of the debugging info?
A quick search shows that Apache Directory studio will display the certificate too.

Update:

Openssl 1.1.1 included a patch to add LDAP support (RFC 4511) to s_client and -starttls ldap is now supported. RHEL/CentOS 7 versions of openssl appear to have backported that update (and others) to the openssl 1.0.2k package they ship, as the manual now has 8 additional starttls protocols:

-starttls protocol
send the protocol-specific message(s) to switch to TLS for communication. protocol is a keyword for the intended protocol. Currently, the only supported keywords are smtp, pop3, imap, ftp, xmpp, xmpp-server, irc, postgres, lmtp, nntp, sieve and ldap.

  • 1
    No luck with that ldapsearch command. Strange. I don't see a clear way to retrieve an LDAP cert from a server (other than emailing/SSH) unless it is configured with deprecated LDAPS. EDIT: ldapsearch -d 255 -x -Z -H ldap://my.ldap.server does display the cert but it's a Hex dump. Not so great for cutting and pasting, but it's something. – Server Fault Jul 27 '15 at 19:43
  • Thanks for the update. Currently no backport for Ubuntu LTS, but good to know. – Server Fault Oct 29 '18 at 18:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.