[Fedora-directory-users] Setting up a Debian client for ssl
Steven Jones
Steven.Jones at vuw.ac.nz
Fri Sep 14 02:41:19 UTC 2007
This looks broken?,
8><------
TLS: could not load client CA list
(file:`',dir:`/etc/openldap/cacerts/').
TLS: error:0200A002:system library:opendir:No such file or directory
ssl_cert.c:816
TLS: error:140D7002:SSL
routines:SSL_add_dir_cert_subjects_to_stack:system lib ssl_cert.c:818
8><------
I tried cp'ing the file on the fds server,
cp /opt/fedora-ds/alias/cacert.asc cacert.asc
and changing the debian's client ldap.conf to,
#TLS_CACERTDIR /etc/openldap/cacerts/
TLS_CACERT /etc/openldap/cacerts/cacert.asc
But no joy....
========================
vuwunicvdebian1:/etc/ldap# ldapsearch -d 1 -x -ZZ '(uid=jonesst1)'
ldap_create
ldap_extended_operation_s
ldap_extended_operation
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP 130.195.87.249:389
ldap_new_socket: 3
ldap_prepare_socket: 3
ldap_connect_to_host: Trying 130.195.87.249:389
ldap_connect_timeout: fd: 3 tm: -1 async: 0
ldap_open_defconn: successful
ldap_send_server_request
ber_scanf fmt ({it) ber:
ber_scanf fmt ({) ber:
ber_flush: 31 bytes to sd 3
ldap_result ld 0x8057e30 msgid 1
ldap_chkResponseList ld 0x8057e30 msgid 1 all 1
ldap_chkResponseList returns ld 0x8057e30 NULL
wait4msg ld 0x8057e30 msgid 1 (infinite timeout)
wait4msg continue ld 0x8057e30 msgid 1 all 1
** ld 0x8057e30 Connections:
* host: 130.195.87.249 port: 389 (default)
refcnt: 2 status: Connected
last used: Fri Sep 14 14:32:25 2007
** ld 0x8057e30 Outstanding Requests:
* msgid 1, origid 1, status InProgress
outstanding referrals 0, parent count 0
** ld 0x8057e30 Response Queue:
Empty
ldap_chkResponseList ld 0x8057e30 msgid 1 all 1
ldap_chkResponseList returns ld 0x8057e30 NULL
ldap_int_select
read1msg: ld 0x8057e30 msgid 1 all 1
ber_get_next
ber_get_next: tag 0x30 len 95 contents:
read1msg: ld 0x8057e30 msgid 1 message type extended-result
ber_scanf fmt ({eaa) ber:
read1msg: ld 0x8057e30 0 new referrals
read1msg: mark request completed, ld 0x8057e30 msgid 1
request done: ld 0x8057e30 msgid 1
res_errno: 0, res_error: <>, res_matched: <>
ldap_free_request (origid 1, msgid 1)
ldap_free_connection 0 1
ldap_free_connection: refcnt 1
ldap_parse_extended_result
ber_scanf fmt ({eaa) ber:
ber_scanf fmt (a) ber:
ldap_parse_result
ber_scanf fmt ({iaa) ber:
ber_scanf fmt (x) ber:
ber_scanf fmt (}) ber:
ldap_msgfree
TLS: could not load client CA list
(file:`',dir:`/etc/openldap/cacerts/').
TLS: error:0200A002:system library:opendir:No such file or directory
ssl_cert.c:816
TLS: error:140D7002:SSL
routines:SSL_add_dir_cert_subjects_to_stack:system lib ssl_cert.c:818
ldap_perror
ldap_start_tls: Connect error (-11)
additional info: Start TLS request accepted.Server willing to
negotiate SSL.
Steven Jones
Senior Linux/Unix/San/Vmware System Administrator
APG -Technology Integration Team
Victoria University of Wellington
Phone: +64 4 463 6272
-----Original Message-----
From: fedora-directory-users-bounces at redhat.com
[mailto:fedora-directory-users-bounces at redhat.com] On Behalf Of Richard
Megginson
Sent: Friday, 14 September 2007 2:29 p.m.
To: General discussion list for the Fedora Directory server project.
Subject: Re: [Fedora-directory-users] Setting up a Debian client for ssl
Steven Jones wrote:
> I checked DNS and it was indeed broken, but I am connecting to the IP,
>
> Fixing DNS still sees the same error on Debian.
>
Try -d 1 or -v arguments to ldapsearch
> regards
>
> Steven Jones
> Senior Linux/Unix/San/Vmware System Administrator
> APG -Technology Integration Team
> Victoria University of Wellington
> Phone: +64 4 463 6272
>
> -----Original Message-----
> From: fedora-directory-users-bounces at redhat.com
> [mailto:fedora-directory-users-bounces at redhat.com] On Behalf Of
Richard
> Megginson
> Sent: Friday, 14 September 2007 1:35 p.m.
> To: General discussion list for the Fedora Directory server project.
> Subject: Re: [Fedora-directory-users] Setting up a Debian client for
ssl
>
> Steven Jones wrote:
>
>> Is this correct/expected?
>>
>> vuwunicvdebian1:/etc/ldap# ldapsearch -x -ZZ '(uid=jonesst1)'
>> ldap_start_tls: Connect error (-11)
>> additional info: Start TLS request accepted.Server willing to
>> negotiate SSL.
>> vuwunicvdebian1:/etc/ldap#
>>
>> On the server I check check the access log for "startTLS" and see it,
>>
>> [14/Sep/2007:13:08:08 +1200] conn=39 fd=67 slot=67 connection from
>> 130.195.87.235 to 130.195.87.249
>> [14/Sep/2007:13:08:08 +1200] conn=39 op=0 EXT
>> oid="1.3.6.1.4.1.1466.20037" name="startTLS"
>> [14/Sep/2007:13:08:08 +1200] conn=39 op=0 RESULT err=0 tag=120
>> nentries=0 etime=0
>> [14/Sep/2007:13:08:08 +1200] conn=39 op=-1 fd=67 closed - Encountered
>> end of file.
>>
>> But the "Connect error (-11)" concerns me.
>>
>>
> I think this can happen if the server cert does not have a subject DN
> that starts with cn=foo.example.com, where foo.example.com is the FQDN
> of the directory server machine. Or, the server cert has a subject DN
> like this:
> cn=foo.example.com,....
> and the client either cannot resolve (via DNS or /etc/hosts or
whatever
> it says in the /etc/nsswitch.conf file) foo.example.com, or the
reverse
> DNS lookup on the server's IP address does not resolve to
> foo.example.com
>
>> Regards
>>
>> Steven
>>
>> --
>> Fedora-directory-users mailing list
>> Fedora-directory-users at redhat.com
>> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>>
>>
>
>
> --
> Fedora-directory-users mailing list
> Fedora-directory-users at redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>
More information about the Fedora-directory-users
mailing list