Re: SSL/TLS issue

To: openldap-technical@openldap.org

Subject: Re: SSL/TLS issue

From: cbulist <cbulist@gmail.com>

Date: Fri, 19 Oct 2012 10:21:07 -0500

Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=message-id:date:from:user-agent:mime-version:to:subject:references :in-reply-to:content-type; bh=r/v+Fcc+rt8Q1sGjl++z/ZASmMTIi1S9vHyeeFEmAkQ=; b=bJLUz1ACVtkWmHDwobugDXARl+EBj8plXE2XzNr49WvOKT1dELxTlGJF3sXY9sMrZc /n3UkSwEM6QExs8rzAT0IgHURfPxFMURMev6vLdbqCKdKZiBglLnYl9L7/TnLrZdqshV SUKKWFdU1xcXKrx3hfsSiF1D+57ComIAcGLAVQfDHlojUDsD6vdGmCJTEwP8jaD5/rpq vfv31WmuGEkDgJtZpMSkpkUH8W5VA9QPU6tfSuW/Ghj2z+bc00jsVZ2NJaLnXuAY7ISa Weh0Ty5WoE+4EeqjKj7fCn7cCt8CsjHhLtDpeGoLk4uJs7MUHDxSJOI190glL8egeDpb tToQ==

In-reply-to: <2398337E30371A47B556742B49C7805B5BF4A10FA5@EXCCRMBX01.Currynet.local>

References: <2398337E30371A47B556742B49C7805B5BF4A10FA5@EXCCRMBX01.Currynet.local>

User-agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.24) Gecko/20111108 Fedora/3.1.16-1.fc14 Thunderbird/3.1.16

-When you create the certificate did you use the FQDN of your server?
-Did you compile openldap with tls support?

On 10/15/2012 10:36 AM, Darouichi, Aziz wrote:

Hi,

I am running Openldap-2.4.32, BD-5.3.21 and openssl-1.0.1c on RHEL 5.5. I created CA cert and singed it but when I run ldeapsearch with –ZZ I get the following error:

TLS trace: SSL_connect:before/connect initialization

TLS trace: SSL_connect:SSLv2/v3 write client hello A

TLS trace: SSL_connect:SSLv3 read server hello A

TLS certificate verification: depth: 1, err: 19, subject: /C=US/ST=Mass/O=Curry College/OU=Technology Center/CN=LDAP-SSL.curry.edu/emailAddress=adarouic@curry.edu, issuer: /C=US/ST=Mass/O=Curry College/OU=Technology Center/CN=LDAP-SSL.curry.edu/emailAddress=adarouic@curry.edu

TLS certificate verification: Error, self signed certificate in certificate chain

TLS trace: SSL3 alert write:fatal:unknown CA

TLS trace: SSL_connect:error in SSLv3 read server certificate B

TLS trace: SSL_connect:error in SSLv3 read server certificate B

TLS: can't connect.

ldap_perror

ldap_start_tls: Connect error (-11)

additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

Please let me know if I missed something in my configuration.

Thanks,

Aziz

References:

SSL/TLS issue
- From: "Darouichi, Aziz" <adarouic@post03.curry.edu>