On 4/06/2014 9:14 p.m., Jose-Marcio Martins wrote: > On 06/03/2014 08:00 PM, Amos Jeffries wrote: >> On 3/06/2014 8:23 a.m., Jose-Marcio Martins wrote: > >> >> What do you see running it manually with that command line? > > Good hint. The same thing, see below. And problem solved !!! > >> If its crashing you could also try running it under a debugger to find >> out why. > > In fact it doesn't crash. It terminates as this is the normal behavior > of the helper when TLS connection fails. > > In fact the problem comes from outside the helper. TLS connection fails > because openldap libraries do check the validity of server certificate. > Although it's a valid certificate, it fails... 8-( > > The solution is to put this lines in /etc/openldap/ldap.conf : > > TLS_REQCERT never > TLS_CRLCHECK none > > Maybe it could be a good idea to force this from inside the helper as > ldap.conf is a server wide configuration and, for some people, not so > easy to debug. If anyone wants to produce a patch the helper definitely needs to print an error message about the TLS failure. Disabling TLS like that is generaly not the right thing to do though. Some more debugging is needed to find out why the cert is valid and still failing verification. Perhapse the LDAP server or Squid machine TLS/SSL library needs updating? or the ca-certificates set used by one of them? or just a tweak of the acceptible ciphersuites? Worst case regenerating the "valid" cert using up-to-date ciphers and key lengths may be necessary if it is a very old cert. Amos
