RE: TLS errors out

["Howard Chu" <hyc@highlandsun.com>]

Try reading the Admin Guide a little more carefully:
http://www.openldap.org/doc/admin21/tls.html

This is also specifically addressed in the FAQ:
http://www.openldap.org/faq/data/cache/185.html

  -- Howard Chu
  Chief Architect, Symas Corp.       Director, Highland Sun
  http://www.symas.com               http://highlandsun.com/hyc
  Symas: Premier OpenSource Development and Support

> -----Original Message-----
> From: owner-openldap-software@OpenLDAP.org
> [mailto:owner-openldap-software@OpenLDAP.org]On Behalf Of Pravin Joshi

> Dear All,
>
> I queried as follows:
> /opt/symas/bin/ldapsearch -d 9 -Z -w mypass -D
> "cn=Manager,dc=test3,dc=test2,dc=mydomain,dc=com" -b ""
> "(objectClass=*)"
>
> Afte initial success messages, when it starts with TLS, I got
> following
> errors:
>
> # Start
> ldap_msgfree
> TLS trace: SSL_connect:before/connect initialization
> TLS trace: SSL_connect:SSLv2/v3 write client hello A
> TLS trace: SSL_connect:SSLv3 read server hello A
> TLS certificate verification: depth: 0, err: 20, subject:
> /C=AU/ST=Some-State/O=
> Internet Widgits Pty Ltd/CN=test3.test2.mydomain.com, issuer: /C=A
> U/ST=Some-State/O=Internet Widgits Pty Ltd/CN=test3.test2.mydomain.com
> TLS certificate verification: Error, unable to get local
> issuer certificate
> TLS trace: SSL3 alert write:fatal:unknown CA
> TLS trace: SSL_connect:error in SSLv3 read server certificate B
> TLS trace: SSL_connect:error in SSLv3 read server certificate B
> TLS: can't connect.
> ldap_perror
> ldap_start_tls: Connect error (91)
>         additional info: error:14090086:SSL
> routines:SSL3_GET_SERVER_CERTIFICATE
> # End (There are other error messages after this)
>
> Now, what I feel is it is trying to do client authentication or else
> comparing the issuer. And it fails there. I am stucked since
> last two days
> on this. Please guide. Thanks in advance.
>
>
> Regards
> Pravin Joshi
>
>