ldap over ssl fails

[Brian May]

Binary package hint: ldap-utils

After converting Debian/etch systems to Ubuntu Hardy, ldap-serch will no longer work unless I disable SSL or disable checking of the server certificate:

--- cut ---
root@oncilla:~# cat /etc/ldap/ldap.conf
#
# LDAP Defaults
#

# See ldap.conf(5) for details
# This file should be world readable but not world writable.

BASE dc=microcomaustralia,dc=com,dc=au
URI ldaps://scrooge.microcomaustralia.com.au
#TLS_CACERT /etc/ssl/certs/class3.pem
TLS_CACERT /etc/ssl/scrooge.pem
TLS_REQCERT demand

#SIZELIMIT 12
#TIMELIMIT 15
#DEREF never
--- cut ---

root@oncilla:~# ldapsearch -x
ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)

However the server is fine, it works with ldapsearch from Debian/etch, and openssl s_client on Ubuntu Hardy:

openssl s_client -verify 1 -CApath /etc/ssl/certs -connect scrooge.microcomaustralia.com.au:ldaps
openssl s_client -verify 1 -CAfile /etc/ssl/scrooge.pem -connect scrooge.microcomaustralia.com.au:ldaps

(both these work)

I also saw #217159, but this appears to be a client side issue, not a server issue.

Brian May

[Brian May (brian-microcomaustralia)]

This bug report may be invalid, it seems ldapsearch is fussy and requires all certificates up the chain be verifiable. So the following commands fixed the problem:

cd /etc/ssl/certs
cat root.pem class3.pem > /etc/ssl/cacert.pem
vim /etc/ldap/ldap.conf to use the value for TLS_CACERT

I believe it is the following: The key is signed by cacerts class 3 certificate which is signed by the root certificate. Some programs (like openvpn and newer versions of ldapsearch) require every certificate up the chain can be verified, however others like openssl s_client are OK with just the class 3 certificate.

Brian May

[Mathias Gug (mathiaz)]

Correct. As mentionned in the Administrator Guide:

If the signing CA was not a top-level (root) CA, certificates for the entire sequence of CA's from the signing CA to the top-level CA should be present.

http://www.openldap.org/doc/admin24/tls.html