I'm currently preparing migration to Samba 4 at my office, and facing issues in my lab network. Installed Samba 4 AD DC on a Debian 9 server, so far it's working properly, could join machines to the domain and access to Samba internal LDAP from external tools using unencrypted ldap://[IP] on port 389.
I'm now trying to configure LDAP access through SSL/TLS following this page instructions:
Wether i'm using autogenerated self-signed certificates or creating a custom one It always fail at the point of verifying the cert:
openssl verify -verbose cert.pem [...] error 18 at 0 depth lookup: self signed certificate error cert.pem: verification failed
I checked private key:
# openssl rsa -check -in key.pem RSA key ok writing RSA key -----BEGIN RSA PRIVATE KEY----- [...] -----END RSA PRIVATE KEY-----
I tried to check if private key and cert are corresponding:
# openssl x509 -noout -modulus -in cert.pem | openssl md5 (stdin)= ce3ca7afcfe6a02ded1ed83938954940 # openssl rsa -noout -modulus -in key.pem | openssl md5 (stdin)= ce3ca7afcfe6a02ded1ed83938954940
Here's global section of my smb.conf file:
tls enabled = yes tls keyfile = tls/key.pem tls certfile = tls/cert.pem tls cafile = tls/ca.pem
I also tried to move the auto-generated files from their original destination
curl commands answers this:
#curl ldaps://host.domain.fr curl: (60) SSL certificate problem: unable to get local issuer certificate
But I successfully connect with a
# curl --insecure ldaps://host.domain.fr # curl --cacert /usr/local/samba/private/tls/ca.pem ldaps://host.domain.fr
Well, any advice about configuration or troubleshooting tips is warmly welcome!