tl;dr Does this error mean that I need to find my company's ldap server's public certificate and install it, or that my company's ldap server needs to install my public cert? If the former, how can I grab the certs and install it?
I'm attempting to integrate an application with my company's LDAP. I'm very new to LDAP and SSL so I apologize in advance. I can do this successfully on non-ssl but am hitting this issue when I attempt to do this over SSL. I am on a Rhel 6.4 with
openldap version 2.4.
ldapsearch -v -h myhost.com -b 'DC=myhost,DC=com, -D 'CN=me,DC=myhost,DC=com' -x -W -Z
import ldap con = ldap.initialize('ldaps://myhost.com') dn = 'CN=me,DC=myhost,DC=com' pw = 'password' con.simple_bind_s(dn, pw)
ldap_start_tls: Connect error (-11) additional info: TLS error -8179:Peer's Certificate issuer is not recognized.
Does this mean that I need to find my company's ldap server's public certificate and install it somewhere, for example, /etc/openldap/certs? Or, does it mean that I need to tell my company's ldap server to approve my public certificate?
openssl s_client -connect myhost.com:636
This dumps a certificate, but at the end says:
Verify return code: 20 (unable to get local issuer certificate)
Again, I'm unsure if this means that I need the ldap server's certs or vice versa.
I did try to see the certificate chain like this:
openssl s_client -showcerts -connect myhost.com:636
I copied the certificates in order and made a file like so, named cert.pem:
-----BEGIN CERTIFICATE----- ... -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE-----
I tried this:
openssl s_client -connect myhost.com:636 -cert /path/to/cert.pem
but it failed with:
unable to load client certificate private key file 140503604590408:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:703: Expecting: ANY PRIVATE KEY
(I also tried -CAfile and -CApath on this, but I received the
unable to get local issuer certificate.)
I recreated the pem file but this time included my server's private key, and cert, followed by the ldap server's certs, but received the same error (
Verify return code: 20 (unable to get local issuer certificate)) again.
Am I creating these certificate files incorrectly?