TLS problems with openldap

[LÉVAI Dániel <leva@ecentrum.hu>]

Hi!

I need some assistance regarding TLS configuration.
So, I'm using OpenLDAP 2.4.11 with debian/testing.
This what my config looks like:
slapd.conf:
[...]
TLSCACertificateFile    /etc/ssl/certs/ecentrum_cacert.pem
TLSCertificateFile      /etc/ldap/tls/openldap_cert.pem
TLSCertificateKeyFile   /etc/ldap/tls/openldap_key.pem
TLSVerifyClient         try
[...]

Slapd starts with these settings gladly, and with a client (eg. 
ldapsearch) without requesting TLS connection, I can get to the invalid 
credentials error (which is what I'm expecting now, this is just testing.).
But with requesting TLS:

$ cat ~/.ldaprc
TLS_CACERT /etc/ssl/certs/ecentrum_cacert.pem
$ ls -l /etc/ssl/certs/ecentrum_cacert.pem
-rw-r--r-- 1 root root [...] /etc/ssl/certs/ecentrum_cacert.pem

$ ldapsearch -d 1 -ZZWx '(objectclass=*)' \
	-H ldap://fileserver.digiszfv:636
ldap_url_parse_ext(ldap://fileserver.digiszfv:636) 

ldap_create 

ldap_url_parse_ext(ldap://fileserver.digiszfv:636/??base) 

ldap_extended_operation_s 

ldap_extended_operation 

ldap_send_initial_request 

ldap_new_connection 1 1 0 

ldap_int_open_connection 

ldap_connect_to_host: TCP fileserver.digiszfv:636 

ldap_new_socket: 3
ldap_prepare_socket: 3
ldap_connect_to_host: Trying 192.168.1.3:636
ldap_pvt_connect: fd: 3 tm: -1 async: 0
ldap_open_defconn: successful
ldap_send_server_request
ber_scanf fmt ({it) ber:
ber_scanf fmt ({) ber:
ber_flush2: 31 bytes to sd 3
ldap_result ld 0x67e0b0 msgid 1
wait4msg ld 0x67e0b0 msgid 1 (infinite timeout)
wait4msg continue ld 0x67e0b0 msgid 1 all 1
** ld 0x67e0b0 Connections:
* host: fileserver.digiszfv  port: 636  (default)
  refcnt: 2  status: Connected
  last used: Mon Oct 27 11:07:53 2008


** ld 0x67e0b0 Outstanding Requests:
 * msgid 1,  origid 1, status InProgress
   outstanding referrals 0, parent count 0
  ld 0x67e0b0 request count 1 (abandoned 0)
** ld 0x67e0b0 Response Queue:
   Empty
  ld 0x67e0b0 response count 0
ldap_chkResponseList ld 0x67e0b0 msgid 1 all 1
ldap_chkResponseList returns ld 0x67e0b0 NULL
ldap_int_select
read1msg: ld 0x67e0b0 msgid 1 all 1
ber_get_next
ldap_free_connection 1 0
ldap_free_connection: actually freed
ldap_err2string
ldap_start_tls: Can't contact LDAP server (-1)


Meanwhile on the server side:
# tail -f syslog
slapd[3779]: slap_listener_activate(9):
slapd[3779]: >>> slap_listener(ldaps://fileserver.digiszfv:636/)
slapd[3779]: connection_get(15): got connid=21
slapd[3779]: connection_read(15): checking for input on id=21
slapd[3779]: connection_read(15): TLS accept failure error=-1 id=21, closing
slapd[3779]: connection_closing: readying conn=21 sd=15 for close
slapd[3779]: connection_close: conn=21 sd=15


The log messages are so terse and/or cryptic, I simply can not figure 
out what could be wrong.
Any help would be appreciated!

Thanks!

Daniel

--
LEVAI Daniel
PGP key ID = 0x4AC0A4B1
Key fingerprint = D037 03B9 C12D D338 4412  2D83 1373 917A 4AC0 A4B1