1

tl;dr Does this error mean that I need to find my company's ldap server's public certificate and install it, or that my company's ldap server needs to install my public cert? If the former, how can I grab the certs and install it?


I'm attempting to integrate an application with my company's LDAP. I'm very new to LDAP and SSL so I apologize in advance. I can do this successfully on non-ssl but am hitting this issue when I attempt to do this over SSL. I am on a Rhel 6.4 with openldap version 2.4.

Using either ldapsearch

ldapsearch -v -h myhost.com -b 'DC=myhost,DC=com, -D 'CN=me,DC=myhost,DC=com' -x -W -Z

or Python

import ldap
con = ldap.initialize('ldaps://myhost.com')
dn = 'CN=me,DC=myhost,DC=com'
pw = 'password'
con.simple_bind_s(dn, pw)

results in:

ldap_start_tls: Connect error (-11)
    additional info: TLS error -8179:Peer's Certificate issuer is not recognized.

Does this mean that I need to find my company's ldap server's public certificate and install it somewhere, for example, /etc/openldap/certs? Or, does it mean that I need to tell my company's ldap server to approve my public certificate?

openssl s_client -connect myhost.com:636

This dumps a certificate, but at the end says:

Verify return code: 20 (unable to get local issuer certificate)

Again, I'm unsure if this means that I need the ldap server's certs or vice versa.

I did try to see the certificate chain like this:

openssl s_client -showcerts -connect myhost.com:636

I copied the certificates in order and made a file like so, named cert.pem:

-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----

I tried this:

openssl s_client -connect myhost.com:636 -cert /path/to/cert.pem 

but it failed with:

unable to load client certificate private key file
140503604590408:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:703:
Expecting: ANY PRIVATE KEY

(I also tried -CAfile and -CApath on this, but I received the unable to get local issuer certificate.)

I recreated the pem file but this time included my server's private key, and cert, followed by the ldap server's certs, but received the same error (Verify return code: 20 (unable to get local issuer certificate)) again.

Am I creating these certificate files incorrectly?

2

The reason why I received those errors was because I did not have the ldap server's certificates installed on my server. The ldap server doesn't need to have my server's certs installed.

I contacted someone within my company who was able to provide two certificates, a root cert and an intermediary cert, both in der format. Notably, these certificates were not the same as those I received using the openssl s_client -showcerts command. I followed this link to convert them from der to pem, like this:

openssl x509 -in root.cer -inform der -outform pem -out root.pem
openssl x509 -in intermediary.cer -inform der -outform pem -out intermediary.pem
# Combine these files into one cert in exactly this order
cat root.pem > master.pem
cat intermediary.pem >> master.pem

I could then issue this command fine

openssl s_client -connect myhost:636 -CAfile /path/to/master.pem

And to connect in Python:

import ldap
# point to the cert
cert_file='/path/to/master.pem'
ldap.set_option(ldap.OPT_X_TLS_CACERTFILE, cert_file)
con = ldap.initialize('ldaps://myhost.com')
dn = 'CN=me,DC=myhost,DC=com'
pw = 'password'
con.simple_bind_s(dn, pw)
  • Had you used the output of openssl s_client, you would not have had to convert from DER to PEM. – Christopher Schultz Oct 3 '16 at 19:19
0

Openldap 2.4 use default port 398 for tls, so try s_client via it. You can check config files in /etc/openldap/slapd.d/, check database instance file cn=olcDatabase={2}hdb.ldif. This file can contain filenames and location of your certs. If your company buy certs from domain provider like goDaddy, you can purchase and use its certs to install with openldap and when you surf on the internet you will not meet red warn from browers because it's worldwide certs. Or you can create your own certs use openssl and install server cert part to your openldap server and install client part to your client to have them able to identify each other.

  • We run the non-ssl ldap on the default 389, and SSL ldap on the default 636. I tried openssl s_client to connect to the non-ssl port and it failed with errno=104, presumably because it doesn't use SSL. – Matthew Moisen Feb 9 '16 at 19:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.