ldapsearch from server does not work but works from client

Hi all,

I have managed to install OpenLdap 2.4 on a RHEL 5.2 workstation. The
basic openldap without TLS/SSL works fine. On the server itself and
from the client I was able to do ldapsearch. However, after I created
a server.pem by going through this : [url=http://
www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ch31_:_Centralized_Logins_Using_LDAP_and_RADIUS]Quick
HOWTO : Ch31 : Centralized Logins Using LDAP and RADIUS - Linux Home
Networking[/url]
ldapsearch on the ldap server itself does not work anymore. The
summary of the configuration is as below:

server.pem is created in /usr/local/etc/openldalp/cacerts and
client.pem is in /etc/openldap/cacerts. client.pem is also moved to
clients and ldapsearch works fine from client workstation. However, in
the ldap server itself it does not. THe output of /etc/ldap.conf looks
like below:

uri ldaps://syna-ldap-02.synamatix.com/
tls_cacertdir /etc/openldap/cacerts
pam_password md5

My /usr/local/etc/openldap/slapd.conf TLS portion looks like below:

TLSCipherSuite HIGH:MEDIUM:+SSLv2:+SSLv3:RSA
TLSCACertificateFile /usr/local/etc/openldap/cacerts/server.pem
TLSCertificateFile /usr/local/etc/openldap/cacerts/server.pem
TLSCertificateKeyFile /usr/local/etc/openldap/cacerts/server.pem
TLSVerifyClient allow

The error from ldapsearch x -H ldaps://syna-ldap-02.synamatix.com -
d127 in the server itself is as below:

TLS ceritficate verification: depth: 0, err: 18, subject: /C=MY/ST=KL/
L=MV/O=MGRC/OU=IT/CN=syna-ldap-02.synamatix.com/
emailAddress=seauyeen@xxxxxxxxxxx, issuer: /C=MY/ST=KL/L=MV/O=MGRC/
OU=IT/CN=syna-ldap-02.synamatix.com/emailAddress=seauyeen@xxxxxxxxxxx
TLS certificate verification: Error, self signed certificate
tls_write: want=7, write=7
0000: 15 03 01 00 02 02 30
TLS trace: SSL3 alert write:fata:unknown CA
TLS trace: SSL connect:error in SSLv3 read server certificate B
TLS trace: SSL_connect:error in SSLv3 read server certificate B
TLS: can't connect: error:14090086:SSL
routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed (self
signed certificate).
ldap_err2string
ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)

On the server end, as I started with debug mode, I get errors below:
TLS trace: SSL3 alert read: fatal: unknown CA
TLS trace: SSL_accept:failed in SSLv3 read client certificate A
TLS: can't accept: erro: 14094418:SSL routines:SSL3_READ_BYTES:tlsv1
alert unknown ca.
connection_read(13): TLS accept failure error=-1 id=1010,closing
......

Why is that ldapsearch from client workstation works fine but not in
the ldap server itself? It is osoo baffling. It is fine without TLS
activated. I have been working on this for 1 week! The information
online does not seem to cater to this weird incident of mine.

Hope to receive some assistance really soon. Thanks and Happy new year
guys!!!!
.

Relevant Pages

  • Re: Need for encryption in WSE 3.0 if using SS-avoid man-in-middle
    ... SSL only validates you are talking to a SSL certified server; ... They can simply edit the URL the client program ... can be done by using a X.509 certificate on both ends, ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: LDP client authentication fails
    ... I got the LDP working with LDAP server under server client authentication ... I did not installed the certificate in pfx format .. ... Client cert auth won't work without that. ...
    (microsoft.public.windows.server.active_directory)
  • Re: SSL & Man In the Middle Attack
    ... >> it possible for the middle man to intercept all messages from server to me ... > server sends client a signed message along with a digital certificate. ... > client generates a random secret key, ...
    (comp.security.misc)
  • Re: activesync issue
    ... On the SBS 2003 Server open the Server Management console. ... On the "Web Server Certificate" page, choose to create a new Web server ... Install the new certificate which created in above step on mobile device: ... Access to browse the Exchange Server 2003 client after you install ...
    (microsoft.public.windows.server.sbs)
  • Re: Need for encryption in WSE 3.0 if using SS-avoid man-in-middle
    ... order to detect we are connected to the wrong server (even though its SSL ... certificate is OK and valid by Verisign); we would need a client certificate. ... this can be detected by SSL/HTTPS client in ...
    (microsoft.public.dotnet.framework.aspnet.security)