OpenLDAP: TLS error -8179:Peer's Certificate issuer is not recognized

ssl openldap
user3748237 picture user3748237 · Jul 30, 2014 · Viewed 26.9k times · Source

I'm not familiar with certificates and openldap. I'm trying to port someone elses work from an older OS to CentOS-6 with openldap-2.4.23. On the old OS, an ldap connection worked without issue. Now on CentOS-6, I get the following error when doing a simple bind:

TLS error -8179:Peer's Certificate issuer is not recognized.

My /etc/openldap/ldap.conf has a single line:

TLS_CACERTDIR   /etc/openldap/certs

I tried commenting out that line and putting the following into the file but that didn't change the error message I received.

tls_reqcert allow

I also tried putting only the following line in ldap.conf but that didn't change the error. I tried this based on information found in this question.

LDAPTLS_CACERT  /etc/ssl/certs/ca-bundle.crt

I copied files into the following directories:

/etc/pki/tls/certs/ca.crt

/etc/pki/tls/certs/server.crt

/etc/pki/tls/private/server.key

I have no choice but to use openldap-2.4.23. Any idea what is causing this error or what I can do to troubleshoot?

Thanks in advance. SP

Answer

Yuvika picture Yuvika · Jul 31, 2014

As per http://www.zytrax.com/books/ldap/ch6/ldap-conf.html TLS_CACERT should point to the file containing the CA cert that the client will use to verify the certificate. You need to make sure the your servers CA [The CA that signed your server certificate] is present in the file that TLS_CACERT points to[in your case /etc/ssl/certs/ca-bundle.crt.

Related questions

How to create a self-signed certificate with OpenSSL

I'm adding HTTPS support to an embedded Linux device. I have tried to generate a self-signed certificate with these steps: openssl req -new > cert.csr openssl rsa -in privkey.pem -out key.pem openssl x509 -in cert.csr -out …

Read More
Getting Chrome to accept self-signed localhost certificate

I have created a self-signed SSL certificate for the localhost CN. Firefox accepts this certificate after initially complaining about it, as expected. Chrome and IE, however, refuse to accept it, even after adding the certificate to the system certificate store …

Read More
Resolving javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed Error?

Edit :- Tried to format the question and accepted answer in more presentable way at mine Blog Here is the original issue. I am getting this error: detailed message sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.…

Read More