Re: Using NSS

[Chris Jacobs <Chris.Jacobs@apollogrp.edu>]

Yes: Specify your cacert file in openldap's ldap.conf file (NOT PADL's in /etc/): typically /etc/openldap/ldap.conf or perhaps /usr/local/openldap/etc/openldap/ldap.conf.

If the cert is signed by a real CA then your system's cacert bundle needs updating.

If not, then I recommend you setup your own internal CA - it doesn't need to always be running nor even have network connectivity.

And use openssl vs mozilla's ssl - my understanding is that it doesn't quite work right; especially when building openldap.

- chris


----- Original Message -----
From: openldap-technical-bounces@OpenLDAP.org <openldap-technical-bounces@OpenLDAP.org>
To: richm@stanfordalumni.org <richm@stanfordalumni.org>
Cc: openldap-technical@openldap.org <openldap-technical@openldap.org>
Sent: Sun Feb 05 03:56:18 2012
Subject: Re: Using NSS

[My, it's been a while.  I got pulled away from this and it's been a
busy few months.  Now I'm beating my head against it some more.]

I backed up and started over with this.  Here is the state of things:

        # certutil -d /etc/pki/nssdb -L

        Certificate Nickname                                         Trust Attributes
                                                                     SSL,S/MIME,JAR/XPI

        LDAP-Server-Cert                                             u,u,u
        CA certificate                                               CTu,u,u

        # certutil -d /etc/pki/nssdb -L -n 'CA certificate'
        Certificate:
            Data:
                Version: 3 (0x2)
                Serial Number: 1000 (0x3e8)
                Signature Algorithm: PKCS #1 SHA-1 With RSA Encryption
                Issuer: "CN=Endoframe CA cert,DC=endoframe,DC=net"
                Validity:
                    Not Before: Tue Jan 17 07:48:20 2012
                    Not After : Mon Jan 17 07:48:20 2022
                Subject: "CN=Endoframe CA cert,DC=endoframe,DC=net"
                Subject Public Key Info:
                    Public Key Algorithm: PKCS #1 RSA Encryption
                    RSA Public Key:

        [snip]

                Signed Extensions:
                    Name: Certificate Basic Constraints
                    Critical: True
                    Data: Is a CA with no maximum path length.

            Signature Algorithm: PKCS #1 SHA-1 With RSA Encryption
            Signature:

        [snip]

            Fingerprint (MD5):

        [snip]

            Fingerprint (SHA1):

        [snip]

            Certificate Trust Flags:
                SSL Flags:
                    Valid CA
                    Trusted CA
                    User
                    Trusted Client CA
                Email Flags:
                    User
                Object Signing Flags:
                    User


        # certutil -d /etc/pki/nssdb -L -n 'LDAP-Server-Cert'
        Certificate:
            Data:
                Version: 3 (0x2)
                Serial Number: 1001 (0x3e9)
                Signature Algorithm: PKCS #1 SHA-1 With RSA Encryption
                Issuer: "CN=Endoframe CA cert,DC=endoframe,DC=net"
                Validity:
                    Not Before: Thu Jan 19 06:13:01 2012
                    Not After : Wed Jan 19 06:13:01 2022
                Subject: "CN=ldap.endoframe.net"
                Subject Public Key Info:
                    Public Key Algorithm: PKCS #1 RSA Encryption
                    RSA Public Key:

        [snip]

            Signature Algorithm: PKCS #1 SHA-1 With RSA Encryption
            Signature:

        [snip]

            Fingerprint (MD5):

        [snip]

            Fingerprint (SHA1):

        [snip]

            Certificate Trust Flags:
                SSL Flags:
                    User
                Email Flags:
                    User
                Object Signing Flags:
                    User

Given the above, I generate the cert for the client:

        # certutil -d /etc/pki/nssdb -L -n LDAP-Server-Cert -a > /etc/openldap/cacerts/ldap-server-cert.pem

In cn=config.ldif, I have:

        olcTLSCACertificatePath: /etc/pki/nssdb
        olcTLSCertificateFile: LDAP-Server-Cert

In ldap.conf, I have:

        TLS_CACERT /etc/openldap/cacerts/ldap-server-cert.pem

Finally, when I run ldapsearch, I get this error:

        # ldapsearch -H ldaps://ldap.endoframe.net -b dc=endoframe,dc=net -x -d1
        ldap_url_parse_ext(ldaps://ldap.endoframe.net)
        ldap_create
        ldap_url_parse_ext(ldaps://ldap.endoframe.net:636/??base)
        ldap_sasl_bind
        ldap_send_initial_request
        ldap_new_connection 1 1 0
        ldap_int_open_connection
        ldap_connect_to_host: TCP ldap.endoframe.net:636
        ldap_new_socket: 3
        ldap_prepare_socket: 3
        ldap_connect_to_host: Trying 10.0.0.21:636
        ldap_pvt_connect: fd: 3 tm: -1 async: 0
        TLS: loaded CA certificate file /etc/openldap/cacerts/ldap-server-cert.pem.
        TLS: certificate [CN=Endoframe CA cert,DC=endoframe,DC=net] is not valid - error -8172:Peer's certificate issuer has been marked as not trusted by the user..
        TLS: error: connect - force handshake failure: errno 21 - moznss error -8172
        TLS: can't connect: TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user..
        ldap_err2string
        ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)

Is there something I need to do to mark the issuer as trusted on the
client?  (The client and server are actually the same machine in this
case, FWIW.)

Braden




This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.