We recently updated the CA certificates on our LDAP host. There are a couple of CentOS 5.x servers which don't seem to have any issues authenticating against the LDAP host, but there's one Centos 6.6 server that isn't able to. I don't know how the server was originally configured, and the system administrator didn't leave much in the way of documentation when he left. The ldapsearch client appears to work without any issues. When I run ldapsearch with maximally verbose debug output, I don't see any errors:
$ ldapsearch -h ldap.hostname.com -x -LLL -v -d 167 -s base -b "" 2>&1 | grep -i error
res_errno: 0, res_error: <>, res_matched: <>
res_errno: 0, res_error: <>, res_matched: <>
Here is the output from the openssl s_client utility:
$ openssl s_client -connect ldap.hostname.com:636 < /dev/null
CONNECTED(00000003)
depth=3 C = SE, O = AddTrust AB, OU = AddTrust External TTP Network, CN = AddTrust External CA Root
verify return:1
depth=2 C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust RSA Certification Authority
verify return:1
depth=1 C = US, ST = MI, L = Ann Arbor, O = Internet2, OU = InCommon, CN = InCommon RSA Server CA
verify return:1
depth=0 C = , postalCode = , ST = , L = , street = , O = , OU = , CN = ldap.hostname.com
verify return:1
---
Certificate chain
0 s:/C=US/postalCode=/ST=/L=/street=/OU=/CN=ldap.hostname.com
i:/C=US/ST=MI/L=Ann Arbor/O=Internet2/OU=InCommon/CN=InCommon RSA Server CA
1 s:/C=US/ST=MI/L=Ann Arbor/O=Internet2/OU=InCommon/CN=InCommon RSA Server CA
i:/C=US/ST=New Jersey/L=Jersey City/O=The USERTRUST Network/CN=USERTrust RSA Certification Authority
2 s:/C=US/ST=New Jersey/L=Jersey City/O=The USERTRUST Network/CN=USERTrust RSA Certification Authority
i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
3 s:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
---
Server certificate
-----BEGIN CERTIFICATE-----
[...]
-----END CERTIFICATE-----
subject=/C=/postalCode=/ST=/L=/street=/O=/OU=/CN=ldap.hostname.com
issuer=/C=US/ST=MI/L=Ann Arbor/O=Internet2/OU=InCommon/CN=InCommon RSA Server CA
---
No client certificate CA names sent
---
SSL handshake has read 5715 bytes and written 607 bytes
---
New, TLSv1/SSLv3, Cipher is AES256-SHA256
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
Protocol : TLSv1.2
Cipher : AES256-SHA256
Session-ID: [...]
Session-ID-ctx:
Master-Key: [...]
Key-Arg : None
Krb5 Principal: None
PSK identity: None
PSK identity hint: None
Start Time: [...]
Timeout : 300 (sec)
Verify return code: 0 (ok)
---
DONE
When I run nslcd in debug mode, I find the following errors:
$ sudo nslcd -d -d -d 2>&1 > nslcd.log
$ cat nslcd.log | grep -i error
res_errno: 0, res_error: <>, res_matched: <>
TLS: cannot open certdb '/etc/openldap/cacerts', error -8018:Unknown PKCS #11 error.
TLS: certificate [...] is not valid - error -8172:Peer's certificate issuer has been marked as not trusted by the user..
TLS: error: connect - force handshake failure: errno 0 - moznss error -8172
TLS: can't connect: TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user..
nslcd: [8b4567] ldap_start_tls_s() failed: Connect error (uri="ldap://ldap.hostname.com/")
nslcd: [8b4567] failed to bind to LDAP server ldap://ldap.hostname.com/: Connect error
res_errno: 0, res_error: <>, res_matched: <>
[...]
Here are the contents of /etc/ldap.conf:
base o=org
timelimit 120
bind_timelimit 120
idle_timelimit 3600
nss_initgroups_ignoreusers root,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman,nscd,gdm
nss_map_attribute uniqueMember member
nss_base_passwd ou=People,?one
nss_base_group ou=Group,?one
tls_cert
tls_key
uri ldap://ldap.hostname.com
ssl start_tls
TLS_CACERTDIR /etc/openldap/certs
pam_password md5
SUDOERS_BASE ou=SUDOers,o=org
Here are the contents of /etc/openldap/ldap.conf:
TLS_CACERTDIR /etc/openldap/certs
URI ldap://ldap.hostname.com/
BASE o=org
And here are the contents of /etc/nslcd.conf:
uid nslcd
gid ldap
uri ldap://ldap.hostname.com/
base o=org
ssl start_tls
tls_cacertdir /etc/openldap/cacerts
tls_cacertfile /etc/openldap/cacerts/authconfig_downloaded.pem
I've googled the error messages, but I'm more than a little overwhelmed by all the different LDAP documentation that I've found online. Any advice would be greatly appreciated.
