[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: Problems when query LDAP with SSL in HEAD



>>>>> "Anthony" == Anthony Brock <abrock@georgefox.edu> writes:

    Anthony> I am attempting to query an LDAP server using SSL, but am
    Anthony> not able to encrypt the connection when using the command
    Anthony> line tools.

OpenLDAP version above 2.0.something is more strict of the correct
hostname in the certificate. Make sure you access the same hostname
as is specified there.

    Anthony> TLS trace: SSL3 alert read:warning:bad certificate

Yes, that's looks like the one...


For example, I specified 'ldap.bayour.com' when creating my SSL certificate,
but if I access the LDAP database with 'localhost' (or something else I have
CNAME'd it to), I get this problem...

Does not work:
----- s n i p -----
[papadoc.pts/3]$ ldapsearch -H ldap:/// -p 389 -x -b "" -s base -LLL -ZZ supportedSASLMechanisms
ldap_start_tls: Connect error
[papadoc.pts/3]$ ldapsearch -H ldaps:/// -x -b "" -s base -LLL supportedSASLMechanisms
ldap_bind: Can't contact LDAP server
----- s n i p -----

DOES work:
----- s n i p -----
[papadoc.pts/3]$ ldapsearch -H ldap://ldap.bayour.com/ -p 389 -x -b "" -s base -LLL -ZZ supportedSASLMechanisms
dn:
supportedSASLMechanisms: GSSAPI
supportedSASLMechanisms: LOGIN
supportedSASLMechanisms: PLAIN

[papadoc.pts/3]$ ldapsearch -H ldaps://ldap.bayour.com/ -x -b "" -s base -LLL supportedSASLMechanisms
dn:
supportedSASLMechanisms: GSSAPI
supportedSASLMechanisms: LOGIN
supportedSASLMechanisms: PLAIN

----- s n i p -----


Look at the URLs:
http://www.bayour.com/LDAPv3-HOWTO.html#3.1.4.Creating%20SSL%20certificate|outline
http://www.bayour.com/LDAPv3-HOWTO.html#3.5.4.2.Testing%20OpenLDAP,%20simple/anonymous%20bind,%20with%20SSL/TLS|outline