[Fedora-directory-users] Setting up a Debian client for ssl
Steven Jones
Steven.Jones at vuw.ac.nz
Fri Sep 14 02:00:29 UTC 2007
I checked DNS and it was indeed broken, but I am connecting to the IP,
Fixing DNS still sees the same error on Debian.
regards
Steven Jones
Senior Linux/Unix/San/Vmware System Administrator
APG -Technology Integration Team
Victoria University of Wellington
Phone: +64 4 463 6272
-----Original Message-----
From: fedora-directory-users-bounces at redhat.com
[mailto:fedora-directory-users-bounces at redhat.com] On Behalf Of Richard
Megginson
Sent: Friday, 14 September 2007 1:35 p.m.
To: General discussion list for the Fedora Directory server project.
Subject: Re: [Fedora-directory-users] Setting up a Debian client for ssl
Steven Jones wrote:
> Is this correct/expected?
>
> vuwunicvdebian1:/etc/ldap# ldapsearch -x -ZZ '(uid=jonesst1)'
> ldap_start_tls: Connect error (-11)
> additional info: Start TLS request accepted.Server willing to
> negotiate SSL.
> vuwunicvdebian1:/etc/ldap#
>
> On the server I check check the access log for "startTLS" and see it,
>
> [14/Sep/2007:13:08:08 +1200] conn=39 fd=67 slot=67 connection from
> 130.195.87.235 to 130.195.87.249
> [14/Sep/2007:13:08:08 +1200] conn=39 op=0 EXT
> oid="1.3.6.1.4.1.1466.20037" name="startTLS"
> [14/Sep/2007:13:08:08 +1200] conn=39 op=0 RESULT err=0 tag=120
> nentries=0 etime=0
> [14/Sep/2007:13:08:08 +1200] conn=39 op=-1 fd=67 closed - Encountered
> end of file.
>
> But the "Connect error (-11)" concerns me.
>
I think this can happen if the server cert does not have a subject DN
that starts with cn=foo.example.com, where foo.example.com is the FQDN
of the directory server machine. Or, the server cert has a subject DN
like this:
cn=foo.example.com,....
and the client either cannot resolve (via DNS or /etc/hosts or whatever
it says in the /etc/nsswitch.conf file) foo.example.com, or the reverse
DNS lookup on the server's IP address does not resolve to
foo.example.com
> Regards
>
> Steven
>
> --
> Fedora-directory-users mailing list
> Fedora-directory-users at redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>
More information about the Fedora-directory-users
mailing list