[Fedora-directory-users] Setting up a Debian client for ssl

Richard Megginson rmeggins at redhat.com
Fri Sep 14 02:51:43 UTC 2007 

Steven Jones wrote:
> This looks broken?,
>
> 8><------
>
> TLS: could not load client CA list
> (file:`',dir:`/etc/openldap/cacerts/').
> TLS: error:0200A002:system library:opendir:No such file or directory
> ssl_cert.c:816
> TLS: error:140D7002:SSL
> routines:SSL_add_dir_cert_subjects_to_stack:system lib ssl_cert.c:818
>
> 8><------
>
> I tried cp'ing the file on the fds server,
>
> cp /opt/fedora-ds/alias/cacert.asc cacert.asc
>
> and changing the debian's client ldap.conf to,
>
> #TLS_CACERTDIR /etc/openldap/cacerts/
> TLS_CACERT /etc/openldap/cacerts/cacert.asc
>
> But no joy....
>
> ========================
>
> vuwunicvdebian1:/etc/ldap# ldapsearch -d 1 -x -ZZ '(uid=jonesst1)'
> ldap_create
> ldap_extended_operation_s
> ldap_extended_operation
> ldap_send_initial_request
> ldap_new_connection 1 1 0
> ldap_int_open_connection
> ldap_connect_to_host: TCP 130.195.87.249:389
> ldap_new_socket: 3
> ldap_prepare_socket: 3
> ldap_connect_to_host: Trying 130.195.87.249:389
> ldap_connect_timeout: fd: 3 tm: -1 async: 0
> ldap_open_defconn: successful
> ldap_send_server_request
> ber_scanf fmt ({it) ber:
> ber_scanf fmt ({) ber:
> ber_flush: 31 bytes to sd 3
> ldap_result ld 0x8057e30 msgid 1
> ldap_chkResponseList ld 0x8057e30 msgid 1 all 1
> ldap_chkResponseList returns ld 0x8057e30 NULL
> wait4msg ld 0x8057e30 msgid 1 (infinite timeout)
> wait4msg continue ld 0x8057e30 msgid 1 all 1
> ** ld 0x8057e30 Connections:
> * host: 130.195.87.249  port: 389  (default)
>   refcnt: 2  status: Connected
>   last used: Fri Sep 14 14:32:25 2007
>  
> ** ld 0x8057e30 Outstanding Requests:
>  * msgid 1,  origid 1, status InProgress
>    outstanding referrals 0, parent count 0
> ** ld 0x8057e30 Response Queue:
>    Empty
> ldap_chkResponseList ld 0x8057e30 msgid 1 all 1
> ldap_chkResponseList returns ld 0x8057e30 NULL
> ldap_int_select
> read1msg: ld 0x8057e30 msgid 1 all 1
> ber_get_next
> ber_get_next: tag 0x30 len 95 contents:
> read1msg: ld 0x8057e30 msgid 1 message type extended-result
> ber_scanf fmt ({eaa) ber:
> read1msg: ld 0x8057e30 0 new referrals
> read1msg:  mark request completed, ld 0x8057e30 msgid 1
> request done: ld 0x8057e30 msgid 1
> res_errno: 0, res_error: <>, res_matched: <>
> ldap_free_request (origid 1, msgid 1)
> ldap_free_connection 0 1
> ldap_free_connection: refcnt 1
> ldap_parse_extended_result
> ber_scanf fmt ({eaa) ber:
> ber_scanf fmt (a) ber:
> ldap_parse_result
> ber_scanf fmt ({iaa) ber:
> ber_scanf fmt (x) ber:
> ber_scanf fmt (}) ber:
> ldap_msgfree
> TLS: could not load client CA list
> (file:`',dir:`/etc/openldap/cacerts/').
> TLS: error:0200A002:system library:opendir:No such file or directory
> ssl_cert.c:816
> TLS: error:140D7002:SSL
> routines:SSL_add_dir_cert_subjects_to_stack:system lib ssl_cert.c:818
> ldap_perror
> ldap_start_tls: Connect error (-11)
>         additional info: Start TLS request accepted.Server willing to
> negotiate SSL.
>   
I'm not sure.  It says "No such file or directory" - permissions?
http://directory.fedoraproject.org/wiki/Howto:SSL#Configure_LDAP_clients
>
>
> Steven Jones
> Senior  Linux/Unix/San/Vmware System Administrator
> APG -Technology Integration Team
> Victoria University of Wellington
> Phone: +64 4 463 6272
>
> -----Original Message-----
> From: fedora-directory-users-bounces at redhat.com
> [mailto:fedora-directory-users-bounces at redhat.com] On Behalf Of Richard
> Megginson
> Sent: Friday, 14 September 2007 2:29 p.m.
> To: General discussion list for the Fedora Directory server project.
> Subject: Re: [Fedora-directory-users] Setting up a Debian client for ssl
>
> Steven Jones wrote:
>   
>> I checked DNS and it was indeed broken, but I am connecting to the IP,
>>
>> Fixing DNS still sees the same error on Debian.
>>   
>>     
> Try -d 1 or -v arguments to ldapsearch
>   
>> regards
>>
>> Steven Jones
>> Senior  Linux/Unix/San/Vmware System Administrator
>> APG -Technology Integration Team
>> Victoria University of Wellington
>> Phone: +64 4 463 6272
>>
>> -----Original Message-----
>> From: fedora-directory-users-bounces at redhat.com
>> [mailto:fedora-directory-users-bounces at redhat.com] On Behalf Of
>>     
> Richard
>   
>> Megginson
>> Sent: Friday, 14 September 2007 1:35 p.m.
>> To: General discussion list for the Fedora Directory server project.
>> Subject: Re: [Fedora-directory-users] Setting up a Debian client for
>>     
> ssl
>   
>> Steven Jones wrote:
>>   
>>     
>>> Is this correct/expected?
>>>
>>> vuwunicvdebian1:/etc/ldap# ldapsearch -x -ZZ '(uid=jonesst1)'
>>> ldap_start_tls: Connect error (-11)
>>>         additional info: Start TLS request accepted.Server willing to
>>> negotiate SSL.
>>> vuwunicvdebian1:/etc/ldap#
>>>
>>> On the server I check check the access log for "startTLS" and see it,
>>>
>>> [14/Sep/2007:13:08:08 +1200] conn=39 fd=67 slot=67 connection from
>>> 130.195.87.235 to 130.195.87.249
>>> [14/Sep/2007:13:08:08 +1200] conn=39 op=0 EXT
>>> oid="1.3.6.1.4.1.1466.20037" name="startTLS"
>>> [14/Sep/2007:13:08:08 +1200] conn=39 op=0 RESULT err=0 tag=120
>>> nentries=0 etime=0
>>> [14/Sep/2007:13:08:08 +1200] conn=39 op=-1 fd=67 closed - Encountered
>>> end of file.
>>>
>>> But the "Connect error (-11)" concerns me.
>>>   
>>>     
>>>       
>> I think this can happen if the server cert does not have a subject DN 
>> that starts with cn=foo.example.com, where foo.example.com is the FQDN
>>     
>
>   
>> of the directory server machine.  Or, the server cert has a subject DN
>>     
>
>   
>> like this:
>> cn=foo.example.com,....
>> and the client either cannot resolve (via DNS or /etc/hosts or
>>     
> whatever 
>   
>> it says in the /etc/nsswitch.conf file) foo.example.com, or the
>>     
> reverse 
>   
>> DNS lookup on the server's IP address does not resolve to
>> foo.example.com
>>   
>>     
>>> Regards
>>>
>>> Steven 
>>>
>>> --
>>> Fedora-directory-users mailing list
>>> Fedora-directory-users at redhat.com
>>> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>>>   
>>>     
>>>       
>> --
>> Fedora-directory-users mailing list
>> Fedora-directory-users at redhat.com
>> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>>   
>>     
>
>
> --
> Fedora-directory-users mailing list
> Fedora-directory-users at redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>   

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/fedora-directory-users/attachments/20070913/a85fbf04/attachment.bin>

More information about the Fedora-directory-users mailing list