9

Configuring StartTLS for OpenLDAP.

  • Ubuntu server 16.04
  • Slapd 2.4.42+dfsg-2ubuntu3.2

I have my own internal Certificate authority that is providing certificates.

I have set up certificates and key: in /etc/ssl/certs:

-rw-r----- 1 root ssl-cert   3268 Jul 14 23:02 ldaptest.roenix.net.cert.pem

lrwxrwxrwx 1 root root         51 Jul  2 13:22 roenix.ca.cert.pem -> /usr/local/share/ca-certificates/roenix.ca.cert.crt

in /etc/ssl/private:

-rw-r----- 1 root ssl-cert 3243 Jul 14 23:01 ldaptest.roenix.net.key.pem

I have correctly set hostname:

@ldaptest:/etc/ssl/certs$ hostname -f
ldaptest.roenix.net

I try to add the configuration to slapd with this LDIF:

dn: cn=config
changetype: modify
add: olcTLSCACertificateFile
olcTLSCACertificateFile: /etc/ssl/certs/roenix.ca.cert.pem
-
add: olcTLSCertificateFile
olcTLSCertificateFile: /etc/ssl/certs/ldaptest.roenix.net.cert.pem
-
add: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/ssl/private/ldaptest.roenix.net.key.pem

With the command:

sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f certinfo.ldif

I get this error:

SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "cn=config"
ldap_modify: Other (e.g., implementation specific) error (80)

Any help greatly appreciated!

4
  • 1
    Normally slapd runs as user openldap. You should give read access to this user for the TLS files.
    – Thomas
    Jul 15, 2017 at 11:56
  • Thanks Thomas! I failed to mention I made user openldap a member of the group open-ssl. Do you recommend a different method of giving access?
    – Ph4edrus
    Jul 15, 2017 at 14:40
  • 1
    What are the access right on /usr/local/share/ca-certificates/roenix.ca.cert.crt? And does the openldap user can change into /etc/ssl/private? Which manual did you follow?
    – Thomas
    Jul 15, 2017 at 14:54
  • Thomas you're an absolute hero! How could I miss the symlink... Changed the group on /usr/local/share/.... and it's fixed!!!!
    – Ph4edrus
    Jul 15, 2017 at 16:23

7 Answers 7

5

I solved this problem by changing the order in the file.ldif like this:

dn: cn=config
changetype: modify
replace: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/openldap/certs/your_key

dn: cn=config 
changetype: modify
replace: olcTLSCertificateFile 
olcTLSCertificateFile: /etc/openldap/certs/your_certificate

and the I ran the command

ldapmodify -Y EXTERNAL -H ldapi:/// -f your_file.ldif 

make sure that there an acl that makes the root eligible to make change with authenticating with SASL bind.

To make sure that changes have been done, run this command

ldapsearch -Y EXTERNAL -H ldapi:/// -b cn=config | grep olcTLS
4
  • 2
    Swapping the order (key, then cert) did it! Thanks!
    – fen
    Apr 26, 2019 at 15:33
  • 1
    it does not for me !!!
    – M2E67
    Oct 5, 2019 at 12:43
  • Swapping the order (Key, then cert did it) Thaks Mar 17, 2020 at 14:43
  • Swapping the order worked for me as well.
    – Assil
    Dec 14, 2021 at 18:33
2

I had the same problem. Certificates were stored in the /opt/local/cert.

You must add this directory to the list of the resolved files in /etc/apparmor.d/local/usr.sbin.slapd:

/opt/local/cert/ r,
/opt/local/cert/* r,
1

This error can be also a permission error. For example if did this command

vim newcerts.ldif

dn: cn=config
changetype: modify
replace: olcTLSCACertificateFile
olcTLSCACertificateFile: /etc/ssl/certs/myca.crt
-
replace: olcTLSCertificateFile
olcTLSCertificateFile: /etc/ssl/certs/ldap1.mydom.crt
-
replace: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/ssl/private/ldap1.mydom.key
-
replace: olcTLSRandFile
olcTLSRandFile: /dev/urandom

then

ldapmodify -Y EXTERNAL -H ldapi:/// -f newcerts.ldif

SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "cn=config"
ldap_modify: Other (e.g., implementation specific) error (80)

but after give with setfacl the permission of read keyfile to openldap user(the certs are usually 644 readable by all)

setfacl -m u:openldap:r-x /etc/ssl/private
setfacl -m u:openldap:r-x /etc/ssl/private/ldap1.mydom.key

all works

ldapmodify -Y EXTERNAL -H ldapi:/// -f newcerts.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "cn=config"
1

I solved the problem just use in the correct order first key then cert. And it worked for me.

dn: cn=config
changetype: modify
replace: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/openldap/certs/myldap.kart.com.key 

dn: cn=config
changetype: modify
replace: olcTLSCertificateFile
olcTLSCertificateFile: /etc/openldap/certs/myldap.kart.com.cert
1

Thomas' comment put me on the right track.

Cause of the problem: I failed to realize that /etc/ssl/certs/roenix.ca.cert.crt is actually a symlink to /usr/local/share/ca-certificates/roenix.ca.cert.crt.

Solution: Set correct permissions on the actual cert file in /usr/local/share/ca-certificates.

Also read the other comments and learned a lot! Thanks all.

0

Problem could also be that SELinux is preventing slapd from read access to the .key and .cert file. Please add policy for the files, dont turn SELinux off.

Having problem with SELinux. Use tool setroubleshoot.

0

To help others like me, this error can also be triggered if you have a key with a passphrase. This seems trivial, but easily forgotten. And of course, the error message doesn't help.

To remove the passphrase, you can use:

openssl rsa -in my.key -out my_no_password.key

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .