[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
Re: configuring ldap-client to use TLS (Certificate not found in database)
On 10/20/15 21:24 -0400, Sridhar Acharya Malkaram wrote:
I am a novice to linux administration. Recently I had to configure a
system to authenticate using LDAP with TLS. I have read guides from
several websites. But I still could configure it. There seem to be several
reasons for the failure. I tried many suggestions, but with no success. I
don’t have access to the LDAP server. So I have been just playing with
config on the client.
The LDAP server is sso.abcdef.edu
My ldap.conf content is below
BASE dc=abcdef,dc=edu
TLS_REQCERT allow
TLS_CACERT /etc/openldap/cacerts/sso.abcdef.edu.crt
uri ldap://sso.abcdef.edu
TLS_CACERTDIR /etc/openldap/cacerts
You output below says your local ldap libraries are linked against moznss.
See:
http://www.openldap.org/faq/data/cache/1514.html
and the ldap.conf manpage. More comments below.
I could issue a ldapsearch -x which returns several entries. However, when
I couldn’t do using TLS. The following command shows some errors. Could
you suggest me possible directions to resolve this. The directory
/etc/openldap/cacerts/ contains the server certificate
sso.abcdef.edu.crt. I also made a copy of it with name sso.abcdef.edu.pem.
I am not sure whether this pem file should be that of the server or the
client.
Another question, should the client also have a ca (or self-signed )
certificate and it whether it should be uploaded onto the LDAP server?
The depends on the security needs of your network.
If the server is configured to require client certificates, then you'll
need to specify a TLS_CERT and TLS_KEY (again, see ldap.conf(5)).
/etc/openldap/cacerts root@wserver[0.5]5019 > ldapsearch -ZZZ -h sso.abcdef.edu -d -1
ldap_msgfree
TLS: loaded CA certificate file /etc/openldap/cacerts/sso.abcdef.edu.crt.
TLS: error: the certificate '/etc/openldap/cacerts/sso.abcdef.edu.pem' could not be found in the database - error -12285:Unable to find the certificate or key necessary for authentication..
TLS: certificate '/etc/openldap/cacerts/sso.abcdef.edu.pem' successfully loaded from PEM file.
TLS: could not add the private key '/etc/openldap/cacerts/sso.abcdef.edu.pem' - error -8018:Unknown PKCS #11 error..
TLS: error: could not initialize moznss security context - error -8018:Unknown PKCS #11 error.
TLS: can't create ssl handle.
ldap_err2string
ldap_start_tls: Connect error (-11)
Does /etc/openldap/cacerts/sso.abcdef.edu.pem exist? If so, moznss will
attempt to open it as a database. It should not exist if you wish to use
the collective cert files within /etc/openldap/cacerts/ as your cacerts.
You should not specify TLS_CACERT in that case either.
--
Dan White