Re: "libldap is using GnuTLS, while FreeRADIUS is using OpenSSL" ????

Alan DeKok via Freeradius-Users <[email protected]> Thu, 4 Dec 2025 11:04:19 -0500

Newsgroups	gmane.comp.freeradius.user
Message-ID	<[email protected]>

On Dec 4, 2025, at 3:45 AM, Marc Fradin <[email protected]> wrote:
> I just installed : *Ubuntu *24.04.2 LTS" and *FreeRADIUS *Version 3.2.5
> 
> We use our LDAP directory for authentication using the `userpasswd` field, which is encoded in SCYPT (EAP/TTLS/PAP).
> 
>  Everything works fine, but it's impossible to perform "LDAP over TLS or SSL" (start_tls = yes in module ldap )

  That is an unfortunately common problem.

>  Here's the error message :
> *!! libldap is using GnuTLS, while FreeRADIUS is using OpenSSL
>     !! There may be random issues with TLS connections due to this conflict.
>    !! The server may also crash.
> *
> 
> *   !! See https://wiki.freeradius.org/modules/Rlm_ldap for more information.*
> 
> How can I fix ? Should I install another library like `libldap`?

  Your choices are:

* don't use TLS with libldap (not really recommended)

* set up a local "stunnel" connection from the FreeRADIUS machine to the machine running LDAP, and use that for the LDAP connections.

* switch libldap to one which uses OpenSSL.  You might be able to download it from https://ltb-project.org/download.html

  I don't know why so many distributions insist on using GnuTLS.  It simply does not do the same things as OpenSSL. Any application which needs a full-featured TLS library cannot use GnuTLS.  It's really only good for "doing TLS" without much of any policies or features.

  Alan DeKok.

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

signature.asc (application/pgp-signature, 833 B)