ssl/tls troubles

--047d7b5d3f1c013ae10502cc3ca0
Content-Type: text/plain; charset=UTF-8

hi,

in my host (fedora 20)I have imported the root CA certificate of our
corporate AD domain. Using ldapsearch it works, and visiting secure sites
signed by that CA are verified.

But I do not exactly know hot to tell my script how to do the same.

This is it:

use Net::LDAP;
use Data::Dumper;

my $ldap = Net::LDAP->new( 'd01.domain.tldl' ) or die "$@";

my $mesg = $ldap->start_tls(
    verify => 'require',
    capath => '/etc/ssl/certs/',
    sslversion => 'tlsv1',
);

print Dumper $mesg;

$mesg =$ldap->bind (
    "user",
     password    => 'pwd',
     version     => 3,
);

my $search = $mesg->search(
                        base    => "dc=domain,dc=tld",
                        scope   => "sub",
                        filter  => "(samaccountname=*)",
                        attr    => ['samaccountname'],
                    );

$mesg->code ;

for my $entry ( $mesg->entries) {
    print $entry->get_value( 'samaccountname'), "\n";;
}

$ldap->unbind;

$ perl department.pl
$VAR1 = bless( {
                 'responseName' => '1.3.6.1.4.1.1466.20037',
                 'matchedDN' => '',
                 'raw' => undef,
                 'mesgid' => 1,
                 'ctrl_hash' => undef,
                 'callback' => undef,
                 'controls' => undef,
                 'resultCode' => 1,
                 'parent' => bless( {
                                      'net_ldap_rawsocket' => bless(
\*Symbol::GEN0, 'IO::Socket::INET' ),
                                      'net_ldap_debug' => 0,
                                      'net_ldap_mesg' => {},
                                      'net_ldap_host' => 'dc01.domain.tld',
                                      'net_ldap_port' => 389,
                                      'net_ldap_async' => 0,
                                      'net_ldap_uri' => 'dc01.domain.tld',
                                      'net_ldap_socket' =>
$VAR1->{'parent'}{'net_ldap_rawsocket'},
                                      'net_ldap_resp' => {},
                                      'net_ldap_scheme' => 'ldap',
                                      'net_ldap_version' => 3,
                                      'net_ldap_refcnt' => 1
                                    }, 'Net::LDAP' ),
                 'errorMessage' => 'SSL connect attempt failed
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify
failed'
               }, 'Net::LDAP::Extension' );
Can't locate object method "search" via package "Net::LDAP::Bind" at
department.pl line 43, <DATA> line 751.


So it clearly does not trust the certificate. The certificate is in
/etc/ssl/certs/ca-bundle.trust.crt.

Any tips greatyl appreciated.


--
Groeten,
natxo

--047d7b5d3f1c013ae10502cc3ca0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: base64

PGRpdiBkaXI9Imx0ciI+PGRpdj48ZGl2PjxkaXY+aGksPGJyPjxicj48L2Rpdj5pbiBteSBob3N0
IChmZWRvcmEgMjApSSBoYXZlIGltcG9ydGVkIHRoZSByb290IENBIGNlcnRpZmljYXRlIG9mIG91
ciBjb3Jwb3JhdGUgQUQgZG9tYWluLiBVc2luZyBsZGFwc2VhcmNoIGl0IHdvcmtzLCBhbmQgdmlz
aXRpbmcgc2VjdXJlIHNpdGVzIHNpZ25lZCBieSB0aGF0IENBIGFyZSB2ZXJpZmllZC48YnI+PGJy
PjwvZGl2PkJ1dCBJIGRvIG5vdCBleGFjdGx5IGtub3cgaG90IHRvIHRlbGwgbXkgc2NyaXB0IGhv
dyB0byBkbyB0aGUgc2FtZS48YnI+PGJyPlRoaXMgaXMgaXQ6PGJyPjxicj51c2UgTmV0OjpMREFQ
Ozxicj51c2UgRGF0YTo6RHVtcGVyOzxicj48YnI+bXkgJGxkYXAgPSBOZXQ6OkxEQVAtJmd0O25l
dyggJiMzOTtkMDEuZG9tYWluLnRsZGwmIzM5OyApIG9yIGRpZSAmcXVvdDskQCZxdW90Ozs8YnI+
PGJyPm15ICRtZXNnID0gJGxkYXAtJmd0O3N0YXJ0X3Rscyg8YnI+wqDCoMKgIHZlcmlmeSA9Jmd0
OyAmIzM5O3JlcXVpcmUmIzM5Oyw8YnI+wqDCoMKgIGNhcGF0aCA9Jmd0OyAmIzM5Oy9ldGMvc3Ns
L2NlcnRzLyYjMzk7LDxicj7CoMKgwqAgc3NsdmVyc2lvbiA9Jmd0OyAmIzM5O3Rsc3YxJiMzOTss
PGJyPik7PGJyPjxicj5wcmludCBEdW1wZXIgJG1lc2c7PGJyPjxicj4kbWVzZyA9JGxkYXAtJmd0
O2JpbmQgKDxicj48L2Rpdj7CoMKgwqAgJnF1b3Q7dXNlciZxdW90Oyw8YnI+PGRpdj7CoMKgwqDC
oCBwYXNzd29yZMKgwqDCoCA9Jmd0OyAmIzM5O3B3ZCYjMzk7LDxicj7CoMKgwqDCoCB2ZXJzaW9u
wqDCoMKgwqAgPSZndDsgMyw8YnI+KTsgPGJyPjxicj5teSAkc2VhcmNoID0gJG1lc2ctJmd0O3Nl
YXJjaCg8YnI+wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBi
YXNlwqDCoMKgID0mZ3Q7ICZxdW90O2RjPWRvbWFpbixkYz10bGQmcXVvdDssPGJyPsKgwqDCoMKg
wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgc2NvcGXCoMKgID0mZ3Q7ICZx
dW90O3N1YiZxdW90Oyw8YnI+wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC
oMKgwqDCoCBmaWx0ZXLCoCA9Jmd0OyAmcXVvdDsoc2FtYWNjb3VudG5hbWU9KikmcXVvdDssPGJy
PsKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgYXR0csKgwqDC
oCA9Jmd0OyBbJiMzOTtzYW1hY2NvdW50bmFtZSYjMzk7XSw8YnI+wqDCoMKgwqDCoMKgwqDCoMKg
wqDCoMKgwqDCoMKgwqDCoMKgwqAgKTs8YnI+PGJyPiRtZXNnLSZndDtjb2RlIDs8YnI+PGJyPmZv
ciBteSAkZW50cnkgKCAkbWVzZy0mZ3Q7ZW50cmllcykgezxicj7CoMKgwqAgcHJpbnQgJGVudHJ5
LSZndDtnZXRfdmFsdWUoICYjMzk7c2FtYWNjb3VudG5hbWUmIzM5OyksICZxdW90O1xuJnF1b3Q7
Ozs8YnI+fTxicj48YnI+JGxkYXAtJmd0O3VuYmluZDs8YnI+PGJyIGNsZWFyPSJhbGwiPjxkaXY+
PGRpdj48ZGl2PiQgcGVybCA8YSBocmVmPSJodHRwOi8vZGVwYXJ0bWVudC5wbCI+ZGVwYXJ0bWVu
dC5wbDwvYT4gPGJyPiRWQVIxID0gYmxlc3MoIHs8YnI+wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg
wqDCoMKgwqAgJiMzOTtyZXNwb25zZU5hbWUmIzM5OyA9Jmd0OyAmIzM5OzEuMy42LjEuNC4xLjE0
NjYuMjAwMzcmIzM5Oyw8YnI+wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgJiMzOTtt
YXRjaGVkRE4mIzM5OyA9Jmd0OyAmIzM5OyYjMzk7LDxicj7CoMKgwqDCoMKgwqDCoMKgwqDCoMKg
wqDCoMKgwqDCoCAmIzM5O3JhdyYjMzk7ID0mZ3Q7IHVuZGVmLDxicj7CoMKgwqDCoMKgwqDCoMKg
wqDCoMKgwqDCoMKgwqDCoCAmIzM5O21lc2dpZCYjMzk7ID0mZ3Q7IDEsPGJyPsKgwqDCoMKgwqDC
oMKgwqDCoMKgwqDCoMKgwqDCoMKgICYjMzk7Y3RybF9oYXNoJiMzOTsgPSZndDsgdW5kZWYsPGJy
PsKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgICYjMzk7Y2FsbGJhY2smIzM5OyA9Jmd0
OyB1bmRlZiw8YnI+wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgJiMzOTtjb250cm9s
cyYjMzk7ID0mZ3Q7IHVuZGVmLDxicj7CoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCAm
IzM5O3Jlc3VsdENvZGUmIzM5OyA9Jmd0OyAxLDxicj7CoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC
oMKgwqDCoCAmIzM5O3BhcmVudCYjMzk7ID0mZ3Q7IGJsZXNzKCB7PGJyPsKgwqDCoMKgwqDCoMKg
wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC
oMKgICYjMzk7bmV0X2xkYXBfcmF3c29ja2V0JiMzOTsgPSZndDsgYmxlc3MoIFwqU3ltYm9sOjpH
RU4wLCAmIzM5O0lPOjpTb2NrZXQ6OklORVQmIzM5OyApLDxicj7CoMKgwqDCoMKgwqDCoMKgwqDC
oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCAm
IzM5O25ldF9sZGFwX2RlYnVnJiMzOTsgPSZndDsgMCw8YnI+wqDCoMKgwqDCoMKgwqDCoMKgwqDC
oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgJiMz
OTtuZXRfbGRhcF9tZXNnJiMzOTsgPSZndDsge30sPGJyPsKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC
oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgICYjMzk7
bmV0X2xkYXBfaG9zdCYjMzk7ID0mZ3Q7ICYjMzk7ZGMwMS5kb21haW4udGxkJiMzOTssPGJyPsKg
wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC
oMKgwqDCoMKgwqDCoMKgICYjMzk7bmV0X2xkYXBfcG9ydCYjMzk7ID0mZ3Q7IDM4OSw8YnI+wqDC
oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg
wqDCoMKgwqDCoMKgwqAgJiMzOTtuZXRfbGRhcF9hc3luYyYjMzk7ID0mZ3Q7IDAsPGJyPsKgwqDC
oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg
wqDCoMKgwqDCoMKgICYjMzk7bmV0X2xkYXBfdXJpJiMzOTsgPSZndDsgJiMzOTtkYzAxLmRvbWFp
bi50bGQmIzM5Oyw8YnI+wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg
wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgJiMzOTtuZXRfbGRhcF9zb2NrZXQmIzM5
OyA9Jmd0OyAkVkFSMS0mZ3Q7eyYjMzk7cGFyZW50JiMzOTt9eyYjMzk7bmV0X2xkYXBfcmF3c29j
a2V0JiMzOTt9LDxicj7CoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC
oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCAmIzM5O25ldF9sZGFwX3Jlc3AmIzM5OyA9
Jmd0OyB7fSw8YnI+wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC
oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgJiMzOTtuZXRfbGRhcF9zY2hlbWUmIzM5OyA9
Jmd0OyAmIzM5O2xkYXAmIzM5Oyw8YnI+wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC
oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgJiMzOTtuZXRfbGRhcF92
ZXJzaW9uJiMzOTsgPSZndDsgMyw8YnI+wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC
oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgJiMzOTtuZXRfbGRhcF9y
ZWZjbnQmIzM5OyA9Jmd0OyAxPGJyPsKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC
oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgfSwgJiMzOTtOZXQ6OkxEQVAmIzM5
OyApLDxicj7CoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCAmIzM5O2Vycm9yTWVzc2Fn
ZSYjMzk7ID0mZ3Q7ICYjMzk7U1NMIGNvbm5lY3QgYXR0ZW1wdCBmYWlsZWQgZXJyb3I6MTQwOTAw
ODY6U1NMIHJvdXRpbmVzOlNTTDNfR0VUX1NFUlZFUl9DRVJUSUZJQ0FURTpjZXJ0aWZpY2F0ZSB2
ZXJpZnkgZmFpbGVkJiMzOTs8YnI+wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCB9LCAmIzM5
O05ldDo6TERBUDo6RXh0ZW5zaW9uJiMzOTsgKTs8YnI+Q2FuJiMzOTt0IGxvY2F0ZSBvYmplY3Qg
bWV0aG9kICZxdW90O3NlYXJjaCZxdW90OyB2aWEgcGFja2FnZSAmcXVvdDtOZXQ6OkxEQVA6OkJp
bmQmcXVvdDsgYXQgPGEgaHJlZj0iaHR0cDovL2RlcGFydG1lbnQucGwiPmRlcGFydG1lbnQucGw8
L2E+IGxpbmUgNDMsICZsdDtEQVRBJmd0OyBsaW5lIDc1MS48YnI+PGJyPjxicj48L2Rpdj48ZGl2
PlNvIGl0IGNsZWFybHkgZG9lcyBub3QgdHJ1c3QgdGhlIGNlcnRpZmljYXRlLiBUaGUgY2VydGlm
aWNhdGUgaXMgaW4gL2V0Yy9zc2wvY2VydHMvY2EtYnVuZGxlLnRydXN0LmNydC48YnI+PGJyPjwv
ZGl2PjxkaXY+QW55IHRpcHMgZ3JlYXR5bCBhcHByZWNpYXRlZC48YnI+PGJyPjxicj48L2Rpdj48
ZGl2Pi0tPGJyPkdyb2V0ZW4sPGJyPm5hdHhvDQo8L2Rpdj48L2Rpdj48L2Rpdj48L2Rpdj48L2Rp
dj4NCg==
--047d7b5d3f1c013ae10502cc3ca0--