16.04: How to specify a certificate authority with ldapsearch

Question

I've been trying to debug LDAP connectivity, so I installed ldapsearch via sudo apt install ldap-utils. Here's the output of the command:

# ldapsearch -x -LLL -H ldaps://myip -d1 -ZZ
ldap_url_parse_ext(ldaps://myip)
ldap_create
ldap_url_parse_ext(ldaps://myip/??base)
ldap_extended_operation_s
ldap_extended_operation
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP myip:636
ldap_new_socket: 4
ldap_prepare_socket: 4
ldap_connect_to_host: Trying myip:636
ldap_pvt_connect: fd: 4 tm: -1 async: 0
attempting to connect: 
connect success
TLS: peer cert untrusted or revoked (0x42)
TLS: can't connect: (unknown error code).
ldap_err2string
ldap_start_tls: Can't contact LDAP server (-1)
    additional info: (unknown error code)

Specifically, I'm focusing on this line: TLS: peer cert untrusted or revoked (0x42)

I did some googling, and found people explaining to set this setting in a file that exists in a directory named /etc/openldap. However, this directory does not exist on the machine--it doesn't seem to have been created during installation of ldap-utils.

I can't figure out if there's a way to either tell ldapsearch to ignore the trust level of the server's cert, or to pass in some sort of CA. What is the appropriate solution here, to continue with connectivity testing?

Answer 1

Add the following line to /etc/ldap/ldap.conf:
TLS_REQCERT never

It will prevent ldapsearch from validating the certificate. So not the most secure option. You can specify a CA certificate with TLS_CACERT /path/to/trusted/ca

Answer 2

This is an old question, but it just happened I've found a proper answer: How to install certificates for command line.

Short story:

• Copy (link) your private CA certificate to /usr/local/share/ca-certificates/;
• Run update-ca-certificates;
• Verify that /etc/ssl/certs/ca-certificates.crt contains your certificate (See https://serverfault.com/questions/590870/how-to-view-all-ssl-certificates-in-a-bundle);

openssl crl2pkcs7 -nocrl -certfile /etc/ssl/certs/ca-certificates.crt | openssl pkcs7 -print_certs -noout | grep "your CA"

• Repeat your ldapsearch, it should succeed now.

Long story:

On Debian/Ubuntu, LDAP tools are built with GnuTLS. GnuTLS does not work with /etc/ssl/certs hash cache. (See note on TLS_CACERTDIR in man ldap.conf.)

c_rehash utility only updates the hash cache, but not /etc/ssl/certs/ca-certificates.crt.

To properly update both hash cache and CA bundle, instead of linking your CA cert into /etc/ssl/certs, place the link into /usr/local/share/ca-certificates/ and run update-ca-certificates.