1

I've been trying to debug LDAP connectivity, so I installed ldapsearch via sudo apt install ldap-utils. Here's the output of the command:

# ldapsearch -x -LLL -H ldaps://myip -d1 -ZZ
ldap_url_parse_ext(ldaps://myip)
ldap_create
ldap_url_parse_ext(ldaps://myip/??base)
ldap_extended_operation_s
ldap_extended_operation
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP myip:636
ldap_new_socket: 4
ldap_prepare_socket: 4
ldap_connect_to_host: Trying myip:636
ldap_pvt_connect: fd: 4 tm: -1 async: 0
attempting to connect: 
connect success
TLS: peer cert untrusted or revoked (0x42)
TLS: can't connect: (unknown error code).
ldap_err2string
ldap_start_tls: Can't contact LDAP server (-1)
    additional info: (unknown error code)

Specifically, I'm focusing on this line: TLS: peer cert untrusted or revoked (0x42)

I did some googling, and found people explaining to set this setting in a file that exists in a directory named /etc/openldap. However, this directory does not exist on the machine--it doesn't seem to have been created during installation of ldap-utils.

I can't figure out if there's a way to either tell ldapsearch to ignore the trust level of the server's cert, or to pass in some sort of CA. What is the appropriate solution here, to continue with connectivity testing?

2

Add the following line to /etc/ldap/ldap.conf:
TLS_REQCERT never

It will prevent ldapsearch from validating the certificate. So not the most secure option. You can specify a CA certificate with TLS_CACERT /path/to/trusted/ca

  • Thanks! That did the trick for my testing purposes. For anyone else messing with a Windows LDAPS AD setup, here's the test command that should return the user information, after making the change mentioned in the above answer: ldapsearch -x -LLL -H ldaps://YOUR_HOST -w 'LDAP_PASS' -D 'LDAP_BIND' -b "DC=lan" 'sAMAccountName=SOME_USER' -d1 -- -d1 will give more verbose debugging information. – vcardillo May 23 '17 at 22:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.