LDAP_OPT_X_TLS_CACERTDIR not working.

To: "openldap-technical@openldap.org" <openldap-technical@openldap.org>, "openldap-its@OpenLDAP.org" <openldap-its@openldap.org>, "mailman@openldap.org" <mailman@openldap.org>, "openldap-devel@openldap.org" <openldap-devel@openldap.org>

Subject: LDAP_OPT_X_TLS_CACERTDIR not working.

From: "Seshadri, Anitha" <anitha.seshadri@emc.com>

Date: Tue, 25 Mar 2014 15:07:37 -0000

Accept-language: en-US

Acceptlanguage: en-US

Content-language: en-US

Dkim-signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=emc.com; s=jan2013; t=1395760030; bh=UdDIhASEZsY25r53A2S3/UHU3Xs=; h=From:To:Date:Subject:Message-ID:Content-Type:MIME-Version; b=Oj7SzhUWdImWZ/Iv35a99v+B3ukVfxso7J/PVAwosdZRCB5H4R1DucxCuy5/2PQL0 S+LPNt198P12EXZ8D9Txp2qQw80TxEZjSNWwCEDiAoOZNb83w3c9o28BR5XlV4HydV 5GufBoHp+IryPHKvH9X5dqb0QLs0VidvBJ6uTEXQ=

Thread-index: Ac9IO3z2U0na1gYtTn6QhuNUxBtTnw==

Thread-topic: LDAP_OPT_X_TLS_CACERTDIR not working.

Hi,

I would like to open a discussion with OpenLDAP team. I hope this is the right email address. If not please let me know the correct to which this mail should be directed to.

Issue:

We are currently using OpenLdap 2.4.16 version on Win 64 .We are using RSA and MES Shareadapter internally to build the openldap libs.

I am getting the below error when I use Sha-256 (2048 key length) certificates:

ldap_sasl_bind_s: Can't contact LDAP server (-1) error:14090086:SSL routines: SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

I am using the option LDAP_OPT_X_TLS_CACERTDIR and pass the cert directory which has the certificates. This fails.
But the same passes when I use LDAP_OPT_X_TLS_CACERTFILE and point to the certicate which is of .pem format.

Can you please let me know I am missing something here or is this a bug?

Any help on this is appreciated.

Thanks
Anitha