Configuring StartTLS for OpenLDAP.

  • Ubuntu server 16.04
  • Slapd 2.4.42+dfsg-2ubuntu3.2

I have my own internal Certificate authority that is providing certificates.

I have set up certificates and key: in /etc/ssl/certs:

-rw-r----- 1 root ssl-cert   3268 Jul 14 23:02 ldaptest.roenix.net.cert.pem

lrwxrwxrwx 1 root root         51 Jul  2 13:22 roenix.ca.cert.pem -> /usr/local/share/ca-certificates/roenix.ca.cert.crt

in /etc/ssl/private:

-rw-r----- 1 root ssl-cert 3243 Jul 14 23:01 ldaptest.roenix.net.key.pem

I have correctly set hostname:

@ldaptest:/etc/ssl/certs$ hostname -f

I try to add the configuration to slapd with this LDIF:

dn: cn=config
changetype: modify
add: olcTLSCACertificateFile
olcTLSCACertificateFile: /etc/ssl/certs/roenix.ca.cert.pem
add: olcTLSCertificateFile
olcTLSCertificateFile: /etc/ssl/certs/ldaptest.roenix.net.cert.pem
add: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/ssl/private/ldaptest.roenix.net.key.pem

With the command:

sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f certinfo.ldif

I get this error:

SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
modifying entry "cn=config"
ldap_modify: Other (e.g., implementation specific) error (80)

Any help greatly appreciated!

  • Normally slapd runs as user openldap. You should give read access to this user for the TLS files. – Thomas Jul 15 '17 at 11:56
  • Thanks Thomas! I failed to mention I made user openldap a member of the group open-ssl. Do you recommend a different method of giving access? – Ph4edrus Jul 15 '17 at 14:40
  • What are the access right on /usr/local/share/ca-certificates/roenix.ca.cert.crt? And does the openldap user can change into /etc/ssl/private? Which manual did you follow? – Thomas Jul 15 '17 at 14:54
  • Thomas you're an absolute hero! How could I miss the symlink... Changed the group on /usr/local/share/.... and it's fixed!!!! – Ph4edrus Jul 15 '17 at 16:23

i had the same problem. Certificates were stored in the /opt/local/cert.

You must add this directory to the list of the resolved files in /etc/apparmor.d/usr.sbin.slapd:

/opt/local/cert/ r,`
/opt/local/cert/* r,

I solved this problem by changing the order in the file.ldif like this:

dn: cn=config
changetype: modify
replace: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/openldap/certs/your_key

dn: cn=config
changetype: modify
replace: olcTLSCertificateFile
olcTLSCertificateFile: /etc/openldap/certs/your_certificate

and the I launched the command ldapmodify -Y EXTERNAL -H ldapi:/// -f your_file.ldif make sure that there an acl that makes the root eligible to make change with authenticating with SASL bind.

To make sure that changes have been done launch this command ldapsearch -Y EXTERNAL -H ldapi:/// -b cn=config | grep olcTLS

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.