[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: Windows Server 2012 R2 - TLS 1.2 connection errors

Jeff Lebo wrote:

Enabled some debug logging on the Windows Server side, and with TLS 1.2
disabled, I see that OpenLDAP is using CipherSuite 0x35, which corresponds
to TLS_RSA_AES_256_CBC_SHA1 in GnuTLS.

I've tried every way possible with slapd.conf, but I can't get slapd to start
with the TLSCipherSuite config trying to disable all TLS1.2, or only
enable TLS_RSA_AES_256_CBC_SHA1.

What am I missing?
Your issue has nothing to do with OpenLDAP and has everything to do with GnuTLS and Windows Server 2012. You should read your GnuTLS docs to see which cipher suites it actually supports in TLS 1.2. And likewise on the Microsoft docs.
Setting the cipher suite doesn't have any effect at all on which protocol version the TLS library will attempt to use. It only affects which cipher suites it will attempt to use once a protocol level has been established. 



------------------------------------------------------------------------------
From: jeflebo@outlook.com
To: openldap-technical@openldap.org
Subject: RE: Windows Server 2012 R2 - TLS 1.2 connection errors
Date: Sat, 1 Nov 2014 10:09:35 -0700

Disabling TLS 1.2 on the Windows Server "fixes" the issue... just not sure
what AD functionality I may be breaking by doing this.

Anyone else dealt with this?

------------------------------------------------------------------------------
From: jeflebo@outlook.com
To: openldap-technical@openldap.org
Subject: Windows Server 2012 R2 - TLS 1.2 connection errors
Date: Sat, 1 Nov 2014 09:45:48 -0700

Have had a public facing OpenLDAP server setup pointing to Windows Server 2008
on the back end for auth.

AD servers are being migrated to Server 2012 R2, and I see this error on the
Windows side when OpenLDAP tries to authenticate to them:

"An TLS 1.2 connection request was received from a remote client application,
but none of the cipher suites supported by the client application are
supported by the server. The SSL connection request has failed."


"A fatal alert was generated and sent to the remote endpoint. This may result
in termination of the connection. The TLS protocol defined fatal error code is
40. The Windows SChannel error state is 1205."


I've spent the last few days trying different configs, and reading Microsoft
forums, and haven't been able to figure it out.  Apparently MS changed the TLS
configs with 2012R2 and it doesn't support a key length I am using.  I've
tried to disable TLS 1.2 on the OpenLDAP side using TLSCiperSuite in
slapd.conf, but OpenLDAP fails to start with "main: TLS init def ctx failed: -1".




--
  -- Howard Chu
  CTO, Symas Corp.           http://www.symas.com
  Director, Highland Sun     http://highlandsun.com/hyc/
  Chief Architect, OpenLDAP  http://www.openldap.org/project/