Steven Jones wrote: > I checked DNS and it was indeed broken, but I am connecting to the IP, > > Fixing DNS still sees the same error on Debian. > Try -d 1 or -v arguments to ldapsearch > regards > > Steven Jones > Senior Linux/Unix/San/Vmware System Administrator > APG -Technology Integration Team > Victoria University of Wellington > Phone: +64 4 463 6272 > > -----Original Message----- > From: fedora-directory-users-bounces at redhat.com > [mailto:fedora-directory-users-bounces at redhat.com] On Behalf Of Richard > Megginson > Sent: Friday, 14 September 2007 1:35 p.m. > To: General discussion list for the Fedora Directory server project. > Subject: Re: Setting up a Debian client for ssl > > Steven Jones wrote: > >> Is this correct/expected? >> >> vuwunicvdebian1:/etc/ldap# ldapsearch -x -ZZ '(uid=jonesst1)' >> ldap_start_tls: Connect error (-11) >> additional info: Start TLS request accepted.Server willing to >> negotiate SSL. >> vuwunicvdebian1:/etc/ldap# >> >> On the server I check check the access log for "startTLS" and see it, >> >> [14/Sep/2007:13:08:08 +1200] conn=39 fd=67 slot=67 connection from >> 130.195.87.235 to 130.195.87.249 >> [14/Sep/2007:13:08:08 +1200] conn=39 op=0 EXT >> oid="1.3.6.1.4.1.1466.20037" name="startTLS" >> [14/Sep/2007:13:08:08 +1200] conn=39 op=0 RESULT err=0 tag=120 >> nentries=0 etime=0 >> [14/Sep/2007:13:08:08 +1200] conn=39 op=-1 fd=67 closed - Encountered >> end of file. >> >> But the "Connect error (-11)" concerns me. >> >> > I think this can happen if the server cert does not have a subject DN > that starts with cn=foo.example.com, where foo.example.com is the FQDN > of the directory server machine. Or, the server cert has a subject DN > like this: > cn=foo.example.com,.... > and the client either cannot resolve (via DNS or /etc/hosts or whatever > it says in the /etc/nsswitch.conf file) foo.example.com, or the reverse > DNS lookup on the server's IP address does not resolve to > foo.example.com > >> Regards >> >> Steven >> >> -- >> Fedora-directory-users mailing list >> Fedora-directory-users at redhat.com >> https://www.redhat.com/mailman/listinfo/fedora-directory-users >> >> > > > -- > Fedora-directory-users mailing list > Fedora-directory-users at redhat.com > https://www.redhat.com/mailman/listinfo/fedora-directory-users > -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 3245 bytes Desc: S/MIME Cryptographic Signature Url : http://lists.fedoraproject.org/pipermail/389-users/attachments/20070913/e0c79643/attachment.bin
