Re: TLS + SSL and openldap

[Michael Ströder <michael@stroeder.com>]

Dieter Kluenter wrote:
> Bruno Steven <aspenbr@gmail.com> writes:
>> I am trying configure openldap work with tls , but I have two question about this, first
>> when I use tls openldap use port 389 and ssl port 639 , is this correct ? 
>> Second How I can test connection between client and server, cryptography is working ? 
> 
> There is no ssl port! SSL (Secure Socket Layer) is a proprietary,
> licence based protocol, owned by Netscape? I don't know whether the
> IPR of this protocol have been part of the Netscape/AOL deal. OpenLDAP,
> and most other network based applications, have implemented Transport
> Layer Security (TLS), RFC 2246. As a LPI certified professional you
> should be aware of this.

Sorry Dieter, don't mess up things. Your comment is at least strongly
misleading: E.g. OpenSSL (also libnss) certainly implements SSLv3 (and even
insecure SSLv2) and you can use that to connect to 3rd party LDAP servers with
the OpenLDAP client libs or connect to OpenLDAP servers.

> OpenLDAP uses port 639,

nb2:~ # grep ldaps /etc/services
ldaps           636/tcp    # ldap protocol over TLS/SSL (was sldap)
ldaps           636/udp    # ldap protocol over TLS/SSL (was sldap)

> You may test your TLS session with:
> openssl s_client -connect localhost:639 -CAfile <file>
                                        ^
636, if slapd was started with -h "ldaps://"

Ciao, Michael.