0

I'm trying to add TLS support to my OpenLDAP instance and according to countless articles i'm supposed to add the following (ldif):

dn: cn=config
add: oclTLSCACertificateFile
olcTLSCACertificateFile: /etc/ldap/ssl/slapd.pem
-
dn: cn=config
add: olcTLSCertificateFile
olcTLSCertificateFile: /etc/ldap/ssl/slapd.pem
-
dn: cn=config
add: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile /etc/ldap/ssl/privkey.pem

I can add the olcTLSCACertificateFile just fine. But not olcTLSCertificateFile or olcTLSCertificateKeyFile for that matter.

ldapmodify just gives me an Implementation specific error (80) which is useless. But ldapadd/slapadd gives me an Unknown attribute error.

So my I checked the schema

# ldapsearch -b cn=schema,cn=config

and sure enough all the olcTLS* attributes are there.

So what am i doing wrong here?

2 Answers 2

0

I solved it with the following ldif

dn: cn=config
add: olcTLSCACertificateFile
olcTLSCACertificateFile: /etc/ldap/ssl/cacert.pem
-
add: olcTLSCertificateFile
olcTLSCertificateFile: /etc/ldap/ssl/slapd_cert.pem
-
add: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/ldap/ssl/slapd_key.pem

Notice that I only have a dn: on the first entry I removed it form the subsequent attributes. In fact i had to use replace: on the olcTLSCACertificateFile because it was already present.

0

Implementation specific error (80) seems to have many possible causes as permissions, ownership and the certificate files accordingly generated. But when I was giving up the order of added attributes really made my day. The one which finally worked for me:

root@ldap:~# cat add7.ldif
dn: cn=config
changetype: modify
add: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/certs/privkey1.pem

root@ldap:~# cat add8.ldif
dn: cn=config
changetype: modify
add: olcTLSCertificateFile
olcTLSCertificateFile: /etc/certs/cert1.pem

root@ldap:~# cat add6.ldif
dn: cn=config
changetype: modify
replace: olcTLSCRLCheck
olcTLSCRLCheck: none

root@ldap:~# cat add5.ldap
dn: cn=config
changetype: modify
add: olcTLSCipherSuite
olcTLSCipherSuite: NORMAL
-
add: olcTLSCACertificateFile
olcTLSCACertificateFile: /etc/certs/fullchain1.pem

root@ldap:~# cat add2.ldap
dn: cn=config
changetype: modify
add: olcTLSProtocolMin
olcTLSProtocolMin: 3.3

root@ldap:~# cat add1.ldap
dn: cn=config
changetype: modify
replace: olcTLSVerifyClient
olcTLSVerifyClient: never

To read in:

ldapmodify -Y EXTERNAL -H ldapi:/// -f add1.ldap

To check:

ldapsearch -Y EXTERNAL -H ldapi:/// -b cn=config | grep olcTLS

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .