Configuring StartTLS for OpenLDAP.
- Ubuntu server 16.04
- Slapd 2.4.42+dfsg-2ubuntu3.2
I have my own internal Certificate authority that is providing certificates.
I have set up certificates and key: in /etc/ssl/certs:
-rw-r----- 1 root ssl-cert 3268 Jul 14 23:02 ldaptest.roenix.net.cert.pem
lrwxrwxrwx 1 root root 51 Jul 2 13:22 roenix.ca.cert.pem -> /usr/local/share/ca-certificates/roenix.ca.cert.crt
in /etc/ssl/private:
-rw-r----- 1 root ssl-cert 3243 Jul 14 23:01 ldaptest.roenix.net.key.pem
I have correctly set hostname:
@ldaptest:/etc/ssl/certs$ hostname -f
ldaptest.roenix.net
I try to add the configuration to slapd with this LDIF:
dn: cn=config
changetype: modify
add: olcTLSCACertificateFile
olcTLSCACertificateFile: /etc/ssl/certs/roenix.ca.cert.pem
-
add: olcTLSCertificateFile
olcTLSCertificateFile: /etc/ssl/certs/ldaptest.roenix.net.cert.pem
-
add: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/ssl/private/ldaptest.roenix.net.key.pem
With the command:
sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f certinfo.ldif
I get this error:
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "cn=config"
ldap_modify: Other (e.g., implementation specific) error (80)
Any help greatly appreciated!
slapd
runs as useropenldap
. You should give read access to this user for the TLS files./usr/local/share/ca-certificates/roenix.ca.cert.crt
? And does theopenldap
user can change into/etc/ssl/private
? Which manual did you follow?