i've been banging my head against the wall with something that seems to be a simple concept. I have two RHEL 6.5 servers. One will be acting as the OpenLDAP server, and one will be a client authenticating via LDAP. It needs to be over TLS using self signed certificates.

I followed this guide for setting up the server: http://linuxgyd.blogspot.com/2014/07/set-up-openldap-server-on-centos-65.html

I followed this guide for setting up the client: http://www.server-world.info/en/note?os=CentOS_6&p=ldap&f=3

Those were the two guides I stuck to mostly, but have looked through dozens of pages online. I am having no luck at all. When trying to connect my client says that the certificate is not trusted. I found articles saying different things about where to place various cert files but I can't seem to find one concise guide to do what I need to do. I unfortunately do not have much experience with SSL/OpenSSL (but am trying to learn).

As a note, I can't seem to get this to work without TLS either - I seem to recall reading a post online stating that RHEL 6.5 requires TLS for OpenLDAP to work (not sure if that is actually true). I am working in virtual machines so if I need to blow everything away, it is not a problem. Any input/advice will be greatly appreciated!

  • I don't have the answer, but I'm trying to tackle the same issue today, and there are many people who run into problems with this. What error is your LDAP client presenting? Do you get the same issue when testing with ldapsearch? Is your server certificate provided by a major vendor, and is the entire certificate chain being presented by the server? – Stefan Lasiewski Mar 16 '16 at 19:35
  • Yeah, many articles are posted about the same issue - but no resolution. When trying to search with ldapsearch I get "32 No such object" and in /var/log/messages I see the message about the certificate not being trusted. My cert is self-signed by the ldap server itself (RHEL 6.5) – 5T4TiC Mar 16 '16 at 19:50
  • You could try TLS_REQCERT never to ignore TLS Verification errors during testing (this is unwise for production as it disables PKI), or explicitly create a new directory to hold the certificate chain, like TLS_CACERTDIR /usr/local/etc/ssl/certs and make sure that the certificates requires for the certificate chain are all present and readable in that directory. – Stefan Lasiewski Mar 16 '16 at 21:28
  • @StefanLasiewski /etc/openldap/certs is typically used for selfsigned / internal certificates. For "globally" recognized certificates use TLS_CACERT /etc/ssl/certs/ca-bundle.crt. – 84104 Mar 17 '16 at 16:50
  • 1
    @StefanLasiewski Yes, but by default /etc/openldap/ldap.conf has TLS_CACERTDIR /etc/openldap/certs . – 84104 Mar 17 '16 at 21:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.