Thanks!<br>changing the uri from ldaps to ldap it works!<br><br>Marco<br><br><br><br><div><span class="gmail_quote">2007/9/7, Richard Megginson <<a href="mailto:rmeggins@redhat.com">rmeggins@redhat.com</a>>:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Marco Strullato wrote:<br>> Hello, I'm using ldapsearch provided by openldap-clients-2.3.27-5.<br>><br>> Marco<br>><br>> 2007/9/7, Satish Chetty <<a href="mailto:satish@suburbia.org.au">satish@suburbia.org.au
</a><br>> <mailto:<a href="mailto:satish@suburbia.org.au">satish@suburbia.org.au</a>>>:<br>><br>> Marco,<br>> Which ldapsearch are you using? OL's or the one that comes<br>> with FDS?
<br>><br>> -Satish.<br>><br>> Marco Strullato wrote:<br>> > Hi all!<br>> > I have a problem with ldap and ssl:<br>> > I set up the fedora directory server with ssl following this link:
<br>> > <a href="http://directory.fedoraproject.org/wiki/Howto:SSL">http://directory.fedoraproject.org/wiki/Howto:SSL</a><br>> > <<a href="http://directory.fedoraproject.org/wiki/Howto:SSL">http://directory.fedoraproject.org/wiki/Howto:SSL
</a>><br>> ><br>> > The problem is client authentication: I mean when I do an<br>> ldapsearch I<br>> > get "SSL connection already established" but I don't have any other
<br>> > connection to between client and server (check with netstat).<br>> ><br>> > What do you suggest me?<br>> ><br>> > Thanks<br>> ><br>> > Marco<br>
> ><br>> > logs from the FDS server are:<br>> > [07/Sep/2007:10:04:09 +0200] conn=10 fd=68 slot=68 SSL<br>> connection from<br>> > <ip_src> to <ip_dst><br>> > [07/Sep/2007:10:04:09 +0200] conn=10 SSL 256-bit AES
<br>> > [07/Sep/2007:10:04:09 +0200] conn=10 op=0 EXT<br>> > oid="1.3.6.1.4.1.1466.20037" name="startTLS"<br>> > [07/Sep/2007:10:04:09 +0200] conn=10 op=0 RESULT err=1 tag=120
<br>> > nentries=0 etime=0<br>> > [07/Sep/2007:10:04:09 +0200] conn=10 op=-1 fd=68 closed - B1<br>><br><br>The problem is that you are attempting to use startTLS on a connection<br>that you have already started TLS/SSL on. The original connection is
<br>already a SSL connection: "conn=10 fd=68 slot=68 SSL connection". Then<br>there is an attempt to startTLS on this connection: "conn=10 op=0 EXT<br> > oid="1.3.6.1.4.1.1466.20037" name="startTLS"". If you want to use
<br>startTLS, you must do so on a non-encrypted connection.<br>><br>> ><br>> > from client:<br>> > ldap_create<br>> > ldap_extended_operation_s<br>> > ldap_extended_operation
<br>> > ldap_send_initial_request<br>> > ldap_new_connection 1 1 0<br>> > ldap_int_open_connection<br>> > ldap_connect_to_host: TCP ldaps_vm02_admin:636<br>> > ldap_new_socket: 3
<br>> > ldap_prepare_socket: 3<br>> > ldap_connect_to_host: Trying <ip_server>:636<br>> > ldap_connect_timeout: fd: 3 tm: -1 async: 0<br>> > TLS trace: SSL_connect:before/connect initialization
<br>> > TLS trace: SSL_connect:SSLv2/v3 write client hello A<br>> > TLS trace: SSL_connect:SSLv3 read server hello A<br>> > TLS certificate verification: depth: 1, err: 0, subject:<br>> /C=IT/O=<......>
<br>> > TLS certificate verification: depth: 0, err: 0, subject:<br>> /C=IT/O=<......><br>> > TLS trace: SSL_connect:SSLv3 read server certificate A<br>> > TLS trace: SSL_connect:SSLv3 read server certificate request A
<br>> > TLS trace: SSL_connect:SSLv3 read server done A<br>> > TLS trace: SSL_connect:SSLv3 write client certificate A<br>> > TLS trace: SSL_connect:SSLv3 write client key exchange A<br>> > TLS trace: SSL_connect:SSLv3 write change cipher spec A
<br>> > TLS trace: SSL_connect:SSLv3 write finished A<br>> > TLS trace: SSL_connect:SSLv3 flush data<br>> > TLS trace: SSL_connect:SSLv3 read finished A<br>> > ldap_open_defconn: successful
<br>> > ldap_send_server_request<br>> > ber_scanf fmt ({it) ber:<br>> > ber_scanf fmt ({) ber:<br>> > ber_flush: 31 bytes to sd 3<br>> > ldap_result ld 0x80bc048 msgid 1<br>
> > ldap_chkResponseList ld 0x80bc048 msgid 1 all 1<br>> > ldap_chkResponseList returns ld 0x80bc048 NULL<br>> > wait4msg ld 0x80bc048 msgid 1 (infinite timeout)<br>> > wait4msg continue ld 0x80bc048 msgid 1 all 1
<br>> > ** ld 0x80bc048 Connections:<br>> > * host: ldaps_vm02_admin port: 636 (default)<br>> > refcnt: 2 status: Connected<br>> > last used: Fri Sep 7 10:05:20 2007<br>> >
<br>> > ** ld 0x80bc048 Outstanding Requests:<br>> > * msgid 1, origid 1, status InProgress<br>> > outstanding referrals 0, parent count 0<br>> > ** ld 0x80bc048 Response Queue:
<br>> > Empty<br>> > ldap_chkResponseList ld 0x80bc048 msgid 1 all 1<br>> > ldap_chkResponseList returns ld 0x80bc048 NULL<br>> > ldap_int_select<br>> > read1msg: ld 0x80bc048 msgid 1 all 1
<br>> > ber_get_next<br>> > ber_get_next: tag 0x30 len 71 contents:<br>> > read1msg: ld 0x80bc048 msgid 1 message type extended-result<br>> > ber_scanf fmt ({eaa) ber:<br>> > read1msg: ld 0x80bc048 0 new referrals
<br>> > read1msg: mark request completed, ld 0x80bc048 msgid 1<br>> > request done: ld 0x80bc048 msgid 1<br>> > res_errno: 0, res_error: <>, res_matched: <><br>> > ldap_free_request (origid 1, msgid 1)
<br>> > ldap_free_connection 0 1<br>> > ldap_free_connection: refcnt 1<br>> > ldap_parse_extended_result<br>> > ber_scanf fmt ({eaa) ber:<br>> > ber_scanf fmt (a) ber:<br>
> > ldap_parse_result<br>> > ber_scanf fmt ({iaa) ber:<br>> > ber_scanf fmt (x) ber:<br>> > ber_scanf fmt (}) ber:<br>> > ldap_msgfree<br>> > ldap_perror<br>> > ldap_start_tls: Operations error (1)
<br>> > additional info: SSL connection already established<br>> ><br>> ><br>> ><br>> ------------------------------------------------------------------------<br>>
<br>> ><br>> > --<br>> > Fedora-directory-users mailing list<br>> > <a href="mailto:Fedora-directory-users@redhat.com">Fedora-directory-users@redhat.com</a><br>> <mailto:<a href="mailto:Fedora-directory-users@redhat.com">
Fedora-directory-users@redhat.com</a>><br>> > <a href="https://www.redhat.com/mailman/listinfo/fedora-directory-users">https://www.redhat.com/mailman/listinfo/fedora-directory-users</a><br>><br>> --
<br>> Fedora-directory-users mailing list<br>> <a href="mailto:Fedora-directory-users@redhat.com">Fedora-directory-users@redhat.com</a><br>> <mailto:<a href="mailto:Fedora-directory-users@redhat.com">
Fedora-directory-users@redhat.com</a>><br>> <a href="https://www.redhat.com/mailman/listinfo/fedora-directory-users">https://www.redhat.com/mailman/listinfo/fedora-directory-users</a><br>><br>><br>> ------------------------------------------------------------------------
<br>><br>> --<br>> Fedora-directory-users mailing list<br>> <a href="mailto:Fedora-directory-users@redhat.com">Fedora-directory-users@redhat.com</a><br>> <a href="https://www.redhat.com/mailman/listinfo/fedora-directory-users">
https://www.redhat.com/mailman/listinfo/fedora-directory-users</a><br>><br><br><br>--<br>Fedora-directory-users mailing list<br><a href="mailto:Fedora-directory-users@redhat.com">Fedora-directory-users@redhat.com</a><br>
<a href="https://www.redhat.com/mailman/listinfo/fedora-directory-users">https://www.redhat.com/mailman/listinfo/fedora-directory-users</a><br><br><br></blockquote></div><br>