1

I have an openldap master and 2 openldap slaves. Using a non self-sign CA.

openldap master: name debian based on stretch
slapd 2.4.44+dfsg-5+d amd64
openssl 1.1.0f-3+deb9u1 amd64


openldap slave: name debian1 based on stretch
slapd 2.4.44+dfsg-5+d amd64
openssl 1.1.0f-3+deb9u1 amd64


openldap master: name ldap based o oracle linux 7.4
slapd 2.4.44-5.el7.x86_64
openssl-1.0.2k-8.0.1.el7.x86_64

openldap client based on oracle linux could not connect to ldap master based on debian strech.

Things that I have done at slave debian and slave oracle linux:

root@debian1:~# openssl verify -CAfile /etc/ssl/contatogs.com.br/cacert.pem /etc/ssl/contatogs.com.br/newcerts/cn\=debian1\,ou\=computers\,dc\=contatogs\,dc\=com\,dc\=br.crt.pem 
/etc/ssl/contatogs.com.br/newcerts/cn=debian1,ou=computers,dc=contatogs,dc=com,dc=br.crt.pem: **OK**

[root@ldap ~]# openssl verify -CAfile /etc/openldap/cacerts/cacert.pem /etc/openldap/certs/cn\=ldap\,ou\=>
/etc/openldap/certs/cn=ldap,ou=computers,dc=contatogs,dc=com,dc=br.crt.pem: **OK**

so far so good 80)

Now possibly problem at debian1 slave:

root@debian1:~# openssl s_client -connect debian.contatogs.com.br:389 -CAfile /etc/ssl/contatogs.com.br/cac
ert.pem  -state 
CONNECTED(00000003)
SSL_connect:before SSL initialization
SSL_connect:SSLv3/TLS write client hello
**SSL_connect:error in SSLv3/TLS write client hello**
write:errno=0
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 176 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : 0000
    Session-ID: 
    Session-ID-ctx: 
    Master-Key: 
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1519415735
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: no

But master/slave with only debian/debian works despite this error/warning.

Now oracle linux does not work at all......

[root@ldap ~]# 
<contatogs.com.br:389 -CAfile /etc/openldap/cacerts/cacert.pem  -state
CONNECTED(00000003)
SSL_connect:before/connect initialization
SSL_connect:SSLv2/v3 write client hello A
139967037114272:error:140790E5:SSL routines:ssl23_write:ssl handshake failure:s23_lib.c:177:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 289 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : 0000
    Session-ID: 
    Session-ID-ctx: 
    Master-Key: 
    Key-Arg   : None
   PSK identity: None
    PSK identity hint: None
    Start Time: 1519415876
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)

I am almost certain that problem is CA, but I don't know to fix...80)

Any help would be very appreciated.

0

Hi for future search I have found the correct way do get rid of this error. When I create the certificate for slave I created using client part ( TLS Web client) and the correct for is to create a certificate as server ( TLS Web server). What help me to discover this error was another post at serverfault w/ this command: openssl verify -purpose sslserver -CAfile cacert.pem ldaprov1.crt

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.