Steven Jones wrote:
This looks broken?, 8><------ TLS: could not load client CA list (file:`',dir:`/etc/openldap/cacerts/'). TLS: error:0200A002:system library:opendir:No such file or directory ssl_cert.c:816 TLS: error:140D7002:SSL routines:SSL_add_dir_cert_subjects_to_stack:system lib ssl_cert.c:818 8><------ I tried cp'ing the file on the fds server, cp /opt/fedora-ds/alias/cacert.asc cacert.asc and changing the debian's client ldap.conf to, #TLS_CACERTDIR /etc/openldap/cacerts/ TLS_CACERT /etc/openldap/cacerts/cacert.asc But no joy.... ======================== vuwunicvdebian1:/etc/ldap# ldapsearch -d 1 -x -ZZ '(uid=jonesst1)' ldap_create ldap_extended_operation_s ldap_extended_operation ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP 130.195.87.249:389 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 130.195.87.249:389 ldap_connect_timeout: fd: 3 tm: -1 async: 0 ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({) ber: ber_flush: 31 bytes to sd 3 ldap_result ld 0x8057e30 msgid 1 ldap_chkResponseList ld 0x8057e30 msgid 1 all 1 ldap_chkResponseList returns ld 0x8057e30 NULL wait4msg ld 0x8057e30 msgid 1 (infinite timeout) wait4msg continue ld 0x8057e30 msgid 1 all 1 ** ld 0x8057e30 Connections: * host: 130.195.87.249 port: 389 (default) refcnt: 2 status: Connected last used: Fri Sep 14 14:32:25 2007** ld 0x8057e30 Outstanding Requests:* msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ** ld 0x8057e30 Response Queue: Empty ldap_chkResponseList ld 0x8057e30 msgid 1 all 1 ldap_chkResponseList returns ld 0x8057e30 NULL ldap_int_select read1msg: ld 0x8057e30 msgid 1 all 1 ber_get_next ber_get_next: tag 0x30 len 95 contents: read1msg: ld 0x8057e30 msgid 1 message type extended-result ber_scanf fmt ({eaa) ber: read1msg: ld 0x8057e30 0 new referrals read1msg: mark request completed, ld 0x8057e30 msgid 1 request done: ld 0x8057e30 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_extended_result ber_scanf fmt ({eaa) ber: ber_scanf fmt (a) ber: ldap_parse_result ber_scanf fmt ({iaa) ber: ber_scanf fmt (x) ber: ber_scanf fmt (}) ber: ldap_msgfree TLS: could not load client CA list (file:`',dir:`/etc/openldap/cacerts/'). TLS: error:0200A002:system library:opendir:No such file or directory ssl_cert.c:816 TLS: error:140D7002:SSL routines:SSL_add_dir_cert_subjects_to_stack:system lib ssl_cert.c:818 ldap_perror ldap_start_tls: Connect error (-11) additional info: Start TLS request accepted.Server willing to negotiate SSL.
I'm not sure. It says "No such file or directory" - permissions? http://directory.fedoraproject.org/wiki/Howto:SSL#Configure_LDAP_clients
Steven Jones Senior Linux/Unix/San/Vmware System Administrator APG -Technology Integration Team Victoria University of Wellington Phone: +64 4 463 6272 -----Original Message----- From: fedora-directory-users-bounces@xxxxxxxxxx [mailto:fedora-directory-users-bounces@xxxxxxxxxx] On Behalf Of Richard Megginson Sent: Friday, 14 September 2007 2:29 p.m. To: General discussion list for the Fedora Directory server project. Subject: Re: Setting up a Debian client for ssl Steven Jones wrote:I checked DNS and it was indeed broken, but I am connecting to the IP, Fixing DNS still sees the same error on Debian.Try -d 1 or -v arguments to ldapsearchregards Steven Jones Senior Linux/Unix/San/Vmware System Administrator APG -Technology Integration Team Victoria University of Wellington Phone: +64 4 463 6272 -----Original Message----- From: fedora-directory-users-bounces@xxxxxxxxxx [mailto:fedora-directory-users-bounces@xxxxxxxxxx] On Behalf OfRichardMegginson Sent: Friday, 14 September 2007 1:35 p.m. To: General discussion list for the Fedora Directory server project. Subject: Re: Setting up a Debian client forsslSteven Jones wrote:I think this can happen if the server cert does not have a subject DN that starts with cn=foo.example.com, where foo.example.com is the FQDNIs this correct/expected? vuwunicvdebian1:/etc/ldap# ldapsearch -x -ZZ '(uid=jonesst1)' ldap_start_tls: Connect error (-11) additional info: Start TLS request accepted.Server willing to negotiate SSL. vuwunicvdebian1:/etc/ldap# On the server I check check the access log for "startTLS" and see it, [14/Sep/2007:13:08:08 +1200] conn=39 fd=67 slot=67 connection from 130.195.87.235 to 130.195.87.249 [14/Sep/2007:13:08:08 +1200] conn=39 op=0 EXT oid="1.3.6.1.4.1.1466.20037" name="startTLS" [14/Sep/2007:13:08:08 +1200] conn=39 op=0 RESULT err=0 tag=120 nentries=0 etime=0 [14/Sep/2007:13:08:08 +1200] conn=39 op=-1 fd=67 closed - Encountered end of file. But the "Connect error (-11)" concerns me.of the directory server machine. Or, the server cert has a subject DNwhateverlike this: cn=foo.example.com,.... and the client either cannot resolve (via DNS or /etc/hosts orreverseit says in the /etc/nsswitch.conf file) foo.example.com, or theDNS lookup on the server's IP address does not resolve to foo.example.comRegardsSteven-- Fedora-directory-users mailing list Fedora-directory-users@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-directory-users-- Fedora-directory-users mailing list Fedora-directory-users@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-directory-users-- Fedora-directory-users mailing list Fedora-directory-users@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-directory-users
Attachment:
smime.p7s
Description: S/MIME Cryptographic Signature
-- Fedora-directory-users mailing list Fedora-directory-users@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-directory-users
