Re: bad certificate error.

["Kervin L. Pierre" <kervin@blueprint-tech.com>]

SSL_get_verify_result() in tls.c returns 18, success is 0.

From the OpenSSL manpage 18 means...

18 X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT: self signed certificate
    the passed certificate is self signed and the same certificate 
cannot be found in the list of trusted certificates.

http://www.openssl.org/docs/apps/verify.html

seen this before?

--Kervin


Kervin L. Pierre wrote:
> changed the port.  I've been looking at the thing too long.
>
> Using s_client to connect to openldap does not produce a ssl error.  But 
> using ldapsearch to connect to s_server produces the following...
>
> # openssl s_server -accept 636 -cert /etc/openldap/slapd.pem
> Using default temp DH parameters
> ACCEPT
> -----BEGIN SSL SESSION PARAMETERS-----
> MHUCAQECAgMBBAIAFgQgVLGdE+ShwXCpmz6qBiRuaRvmBHxx/loIW0BzzmYGKpME
> MEgHZypDjBRwkbk4p1KETYRhlP2DmHGEH9e7+2f6hKzrAQjMevTowgZA+Q+dGrCW
> aKEGAgQ80JRYogQCAgEspAYEBAEAAAA=
> -----END SSL SESSION PARAMETERS-----
> Shared 
> ciphers:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:DES-CBC3-SHA:DHE-DSS-RC4-SHA:RC4-SHA:RC4-MD5:EXP1024-DHE-DSS-RC4-SHA:EXP1024-RC4-SHA:EXP1024-DHE-DSS-DES-CBC-SHA:EXP1024-DES-CBC-SHA:EXP1024-RC2-CBC-MD5:EXP1024-RC4-MD5:EDH-RSA-DES-CBC-SHA:EDH-DSS-DES-CBC-SHA:DES-CBC-SHA:EXP-EDH-RSA-DES-CBC-SHA:EXP-EDH-DSS-DES-CBC-SHA:EXP-DES-CBC-SHA:EXP-RC2-CBC-MD5:EXP-RC4-MD5 
>
> CIPHER is EDH-RSA-DES-CBC3-SHA
> ERROR
> shutting down SSL
> CONNECTION CLOSED
>
> the ldapsearch command is...
> ]$ ldapsearch -x  -H ldaps://bashful.eng.fit.edu/ -b 
> 'dc=my-domain,dc=com' '(objectclass=*)'
>
> Does that mean that the problem is with ldapsearch?
>
> --Kervin
>
>
> Howard Chu wrote:
>
> > > -----Original Message-----
> > > From: Kervin L. Pierre [mailto:kervin@blueprint-tech.com]
> >
> >
> >
> > > With s_client connecting to s_server, everything looks fine.  There 
> > > are no errors reported.  When I try to connect to the OpenLDAP server 
> > > using s_client I get...
> > >
> > > $ openssl s_client -connect bashful.eng.fit.edu:389
> >
> >
> >
> > You're using the cleartext port, you should be using 636 here.
> >
> >
> > > CONNECTED(00000003)
> > > 26420:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake 
> > > failure:s23_lib.c:226:
> >
> >
> >
> > >  -- Howard Chu
> > >  Chief Architect, Symas Corp.       Director, Highland Sun
> > >  http://www.symas.com               http://highlandsun.com/hyc
> > >  Symas: Premier OpenSource Development and Support