Re: Communicate from php/apache to openLDAP over LDAPS

To: Dieter Kluenter <dieter@dkluenter.de>

Subject: Re: Communicate from php/apache to openLDAP over LDAPS

From: Jérémy ESCOLANO <jeremyescolano@gmail.com>

Date: Fri, 11 Jun 2010 11:57:09 +0200

Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:mime-version:received:in-reply-to :references:from:date:message-id:subject:to:cc:content-type; bh=ulU8gAJPzJfJIVH7vhoWJLRuBry4VDDAhtBRrnZbJVE=; b=I+d6M8suTAdKMx5TRKj25JMpuOSvmtZj2llptRuTGOjzuVm5LiuqtBKq97kuI4rKFZ VRK4Ec8j1Rlq47uZvkQkuadxpgKqu+0boDhYhgnolMzesLbONzOZXld8oYzZsRyx/Sk3 TtlWqTewZ3S7vpnnO4krKZZ/0+ttX2YtQRdTc=

Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=ve97ESnGFNq14DZKFtYiK0BiumRoDJ2BDAIOxzDRlBuFqdg0454CfwXJTGRRmgV1T+ W/RaPGt8PfkSN0OFQeHEZpnp1z0s086mZU/aeYBLwPzikzr327RmVJntF55bJI5cvUZ4 35G3ttpfmGnu3GKw6uRHakE1uPwOYlxhxpfnA=

In-reply-to: <20100611114729.0a3f4309@magenta.l4b.de>

References: <AANLkTimZdDamAxBQlKaq9nZugTkpOFxDRg2K7OEHotKU@mail.gmail.com> <C077F5CF-3E9A-4562-8D34-451AB6C9B38A@u-pec.fr> <AANLkTimeVtXNYoDpHjoVBb_2u1QbsN563eKIX1nNt-Ha@mail.gmail.com> <4C11301F.3010009@symas.com> <5BE8F969-F3A3-4A72-A9E6-76D555D8ED58@internode.on.net> <AANLkTiluv2nON6LY_RkH6uCYRRi1iEvkLtBjY4b8Mm9H@mail.gmail.com> <20100611114729.0a3f4309@magenta.l4b.de>

Apache has to verify which certificate ? the CA certificate ? the apache server certificate or the ldap certificate?

Thank you for your information that help me to understand better.

2010/6/11 Dieter Kluenter <dieter@dkluenter.de>

Am Fri, 11 Jun 2010 10:53:59 +0200
schrieb Jérémy ESCOLANO <jeremyescolano@gmail.com>:

> Hi, Thankyou for replying,
>
> I went a bit deeper with my problem, I can now do LDAPS but without
> verifying certificate,
> here is what I did :
>
> on the openLDAP server:
>
> --->slapd.conf
> TLSCertificateFile ./ssl2/srvLDAP.cer
> TLSCertificateKeyFile ./ssl2/srvLDAP.key
> TLSCACertificateFile ./ssl2/cacert.cer
> TLSVerifyClient never
>
> --->ldap.conf
> TLS_CACERT ./ssl2/cacert.cer
> TLS_REQCERT never
>
> Then ran my service using: slapd -h "ldap:/// ldaps:///" -d 1
>
> That's all for the openLDAP server, but not enought with apache.
>
> On the apache server I created a folder C:\openldap\sysconf
> in this directory i created openldap.conf and this contains :
>
> TLS_CACERT ./ssl/cacert.cer
> TLS_REQCERT never
>
> (with cacert.cer in c:\openldap\sysconf\ssl)
>
> It works from now BUT does NOT verify the certificate.

[...]

> TLS: can't accept.
> TLS: error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did
> not return
> a certificate s3_srvr.c:2471
> connection_read(1176): TLS accept error error=-1 id=0, closing
> connection_closing: readying conn=0 sd=1176 for close
> connection_close: conn=0 sd=1176
>
> The question is now : How can I configure my certificate on apache
> SERVER so that I will be able to do LDAPS with PHP and certificates
> will be verified. (I know should ask it on Apache list too)

bear in mind that apache is a ldap client operation, thus configure
ldap clients to verify the server certificate and not the server to
verfiy a client certificate.

-Dieter

--
Dieter Klünter | Systemberatung
sip: +49.40.20932173
http://www.dpunkt.de/buecher/2104.html
GPG Key ID:8EF7B6C6