Re: Setting up a Debian client for ssl

[Richard Megginson <rmeggins@xxxxxxxxxx>]

Steven Jones wrote:
> I checked DNS and it was indeed broken, but I am connecting to the IP,
>
> Fixing DNS still sees the same error on Debian.
>   
Try -d 1 or -v arguments to ldapsearch
> regards
>
> Steven Jones
> Senior  Linux/Unix/San/Vmware System Administrator
> APG -Technology Integration Team
> Victoria University of Wellington
> Phone: +64 4 463 6272
>
> -----Original Message-----
> From: fedora-directory-users-bounces@xxxxxxxxxx
> [mailto:fedora-directory-users-bounces@xxxxxxxxxx] On Behalf Of Richard
> Megginson
> Sent: Friday, 14 September 2007 1:35 p.m.
> To: General discussion list for the Fedora Directory server project.
> Subject: Re:  Setting up a Debian client for ssl
>
> Steven Jones wrote:
>   
> > Is this correct/expected?
> >
> > vuwunicvdebian1:/etc/ldap# ldapsearch -x -ZZ '(uid=jonesst1)'
> > ldap_start_tls: Connect error (-11)
> >         additional info: Start TLS request accepted.Server willing to
> > negotiate SSL.
> > vuwunicvdebian1:/etc/ldap#
> >
> > On the server I check check the access log for "startTLS" and see it,
> >
> > [14/Sep/2007:13:08:08 +1200] conn=39 fd=67 slot=67 connection from
> > 130.195.87.235 to 130.195.87.249
> > [14/Sep/2007:13:08:08 +1200] conn=39 op=0 EXT
> > oid="1.3.6.1.4.1.1466.20037" name="startTLS"
> > [14/Sep/2007:13:08:08 +1200] conn=39 op=0 RESULT err=0 tag=120
> > nentries=0 etime=0
> > [14/Sep/2007:13:08:08 +1200] conn=39 op=-1 fd=67 closed - Encountered
> > end of file.
> >
> > But the "Connect error (-11)" concerns me.
> >   
> >     
> I think this can happen if the server cert does not have a subject DN 
> that starts with cn=foo.example.com, where foo.example.com is the FQDN 
> of the directory server machine.  Or, the server cert has a subject DN 
> like this:
> cn=foo.example.com,....
> and the client either cannot resolve (via DNS or /etc/hosts or whatever 
> it says in the /etc/nsswitch.conf file) foo.example.com, or the reverse 
> DNS lookup on the server's IP address does not resolve to
> foo.example.com
>   
> > Regards
> >
> > Steven 
> >
> > --
> > Fedora-directory-users mailing list
> > Fedora-directory-users@xxxxxxxxxx
> > https://www.redhat.com/mailman/listinfo/fedora-directory-users
> >   
> >     
>
>
> --
> Fedora-directory-users mailing list
> Fedora-directory-users@xxxxxxxxxx
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature

--
Fedora-directory-users mailing list
Fedora-directory-users@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-directory-users