OpenLDAP & Thunderbird with SSL

[Erik Lotspeich <erik@lotspeich.org>]

Hi:

I have OpenLDAP set up and working such that Thunderbird can access my 
addressbook without SSL or authentication.  This part is good, but I want to 
move to the next level.

My OpenLDAP server (slapd) is set up with SASL authentication (using the PLAIN 
method) and a self-signed certificate.  The slapd command line is:

/usr/local/libexec/slapd -h ldap:/// ldaps:///

When I connect to my OpenLDAP server using an OpenLDAP client such as 
ldapsearch, everything works (I have my self-generated CA cert as part of my 
system's ca-bundle):

ldapsearch -ZZ -b 'ou=xxx, dc=yyy,dc=zzz' '(objectclass=*)'

ldapsearch prompts for authentication and returns the contents of my 
addressbook:

SASL/PLAIN authentication started
Please enter your password:
SASL username: erik
SASL SSF: 0
# extended LDIF
#
# LDAPv3
# base <ou=xxx, dc=yyy,dc=zzz> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#
.
.
.

When I enable SSL in Thunderbird, Thunderbird is unable to connect.  I know 
using tcpdump that it's attempting a connection on the SSL port, but is failing 
and giving up somewhere.

Is this a known issue?

In slapd.conf I'm not requiring authentication at the moment.  I will require 
authentication once I get the SSL working; since I'm using PLAIN, I don't want 
to allow non-SSL authentication.

Any help would be greatly appreciated.

Regards,

Erik.