Re: ssl/tls troubles
Daniel Stutz <[email protected]> Thu, 11 Sep 2014 20:57:38 +0200
| Newsgroups | gmane.comp.lang.perl.modules.ldap |
|---|---|
| Message-ID | <[email protected]> |
--Apple-Mail=_50E68457-BE73-4620-8A83-075396D0C438 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=windows-1252 Did you try the =82cafile=91 option of start_tls? http://search.cpan.org/~marschap/perl-ldap/lib/Net/LDAP.pod#start_tls Regards, Daniel Am 11.09.2014 um 17:58 schrieb Natxo Asenjo <[email protected]>: > hi, >=20 > in my host (fedora 20)I have imported the root CA certificate of our = corporate AD domain. Using ldapsearch it works, and visiting secure = sites signed by that CA are verified. >=20 > But I do not exactly know hot to tell my script how to do the same. >=20 > This is it: >=20 > use Net::LDAP; > use Data::Dumper; >=20 > my $ldap =3D Net::LDAP->new( 'd01.domain.tldl' ) or die "$@"; >=20 > my $mesg =3D $ldap->start_tls( > verify =3D> 'require', > capath =3D> '/etc/ssl/certs/', > sslversion =3D> 'tlsv1', > ); >=20 > print Dumper $mesg; >=20 > $mesg =3D$ldap->bind ( > "user", > password =3D> 'pwd', > version =3D> 3, > );=20 >=20 > my $search =3D $mesg->search( > base =3D> "dc=3Ddomain,dc=3Dtld", > scope =3D> "sub", > filter =3D> "(samaccountname=3D*)", > attr =3D> ['samaccountname'], > ); >=20 > $mesg->code ; >=20 > for my $entry ( $mesg->entries) { > print $entry->get_value( 'samaccountname'), "\n";; > } >=20 > $ldap->unbind; >=20 > $ perl department.pl=20 > $VAR1 =3D bless( { > 'responseName' =3D> '1.3.6.1.4.1.1466.20037', > 'matchedDN' =3D> '', > 'raw' =3D> undef, > 'mesgid' =3D> 1, > 'ctrl_hash' =3D> undef, > 'callback' =3D> undef, > 'controls' =3D> undef, > 'resultCode' =3D> 1, > 'parent' =3D> bless( { > 'net_ldap_rawsocket' =3D> bless( = \*Symbol::GEN0, 'IO::Socket::INET' ), > 'net_ldap_debug' =3D> 0, > 'net_ldap_mesg' =3D> {}, > 'net_ldap_host' =3D> = 'dc01.domain.tld', > 'net_ldap_port' =3D> 389, > 'net_ldap_async' =3D> 0, > 'net_ldap_uri' =3D> = 'dc01.domain.tld', > 'net_ldap_socket' =3D> = $VAR1->{'parent'}{'net_ldap_rawsocket'}, > 'net_ldap_resp' =3D> {}, > 'net_ldap_scheme' =3D> 'ldap', > 'net_ldap_version' =3D> 3, > 'net_ldap_refcnt' =3D> 1 > }, 'Net::LDAP' ), > 'errorMessage' =3D> 'SSL connect attempt failed = error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate = verify failed' > }, 'Net::LDAP::Extension' ); > Can't locate object method "search" via package "Net::LDAP::Bind" at = department.pl line 43, <DATA> line 751. >=20 >=20 > So it clearly does not trust the certificate. The certificate is in = /etc/ssl/certs/ca-bundle.trust.crt. >=20 > Any tips greatyl appreciated. >=20 >=20 > -- > Groeten, > natxo --Apple-Mail=_50E68457-BE73-4620-8A83-075396D0C438 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=windows-1252 <html><head><meta http-equiv=3D"Content-Type" content=3D"text/html = charset=3Dwindows-1252"><meta http-equiv=3D"Content-Type" = content=3D"text/html charset=3Dwindows-1252"></head><body = style=3D"word-wrap: break-word; -webkit-nbsp-mode: space; = -webkit-line-break: after-white-space;">Did you try the =82cafile=91 = option of start_tls?<div><a = href=3D"http://search.cpan.org/~marschap/perl-ldap/lib/Net/LDAP.pod#start_= tls">http://search.cpan.org/~marschap/perl-ldap/lib/Net/LDAP.pod#start_tls= </a></div><div><br></div><div>Regards,</div><div>Daniel<br><div><br><div><= div>Am 11.09.2014 um 17:58 schrieb Natxo Asenjo <<a = href=3D"mailto:[email protected]">[email protected]</a>>:</di= v><br class=3D"Apple-interchange-newline"><blockquote type=3D"cite"><div = dir=3D"ltr"><div><div><div>hi,<br><br></div>in my host (fedora 20)I have = imported the root CA certificate of our corporate AD domain. Using = ldapsearch it works, and visiting secure sites signed by that CA are = verified.<br><br></div>But I do not exactly know hot to tell my script = how to do the same.<br><br>This is it:<br><br>use Net::LDAP;<br>use = Data::Dumper;<br><br>my $ldap =3D Net::LDAP->new( 'd01.domain.tldl' ) = or die "$@";<br><br>my $mesg =3D = $ldap->start_tls(<br> verify =3D> = 'require',<br> capath =3D> = '/etc/ssl/certs/',<br> sslversion =3D> = 'tlsv1',<br>);<br><br>print Dumper $mesg;<br><br>$mesg =3D$ldap->bind = (<br></div> "user",<br><div> = password =3D> 'pwd',<br> = version =3D> 3,<br>); <br><br>my $search =3D = $mesg->search(<br>  = ; &= nbsp; base =3D> = "dc=3Ddomain,dc=3Dtld",<br>  = ; &= nbsp; scope =3D> = "sub",<br> &nbs= p; = filter =3D> = "(samaccountname=3D*)",<br>  = ; &= nbsp; attr =3D> = ['samaccountname'],<br> &nb= sp; = );<br><br>$mesg->code ;<br><br>for my $entry ( $mesg->entries) = {<br> print $entry->get_value( 'samaccountname'), = "\n";;<br>}<br><br>$ldap->unbind;<br><br clear=3D"all"><div><div>$ = perl <a href=3D"http://department.pl/">department.pl</a> <br>$VAR1 =3D = bless( = {<br> &nb= sp; 'responseName' =3D> = '1.3.6.1.4.1.1466.20037',<br> &nb= sp; 'matchedDN' =3D> = '',<br> &= nbsp; 'raw' =3D> = undef,<br> &nbs= p; 'mesgid' =3D> = 1,<br> &n= bsp; 'ctrl_hash' =3D> = undef,<br> &nbs= p; 'callback' =3D> = undef,<br> &nbs= p; 'controls' =3D> = undef,<br> &nbs= p; 'resultCode' =3D> = 1,<br> &n= bsp; 'parent' =3D> bless( = {<br> &nb= sp;  = ; &= nbsp; 'net_ldap_rawsocket' =3D> bless( \*Symbol::GEN0, = 'IO::Socket::INET' = ),<br> &n= bsp; &nbs= p; = 'net_ldap_debug' =3D> = 0,<br> &n= bsp; &nbs= p; = 'net_ldap_mesg' =3D> = {},<br> &= nbsp; &nb= sp;  = ; 'net_ldap_host' =3D> = 'dc01.domain.tld',<br> &nbs= p; = &n= bsp; 'net_ldap_port' =3D> = 389,<br> = &n= bsp; &nbs= p; 'net_ldap_async' =3D> = 0,<br> &n= bsp; &nbs= p; = 'net_ldap_uri' =3D> = 'dc01.domain.tld',<br> &nbs= p; = &n= bsp; 'net_ldap_socket' =3D> = $VAR1->{'parent'}{'net_ldap_rawsocket'},<br> &nb= sp;  = ; &= nbsp; 'net_ldap_resp' =3D> = {},<br> &= nbsp; &nb= sp;  = ; 'net_ldap_scheme' =3D> = 'ldap',<br> &nb= sp;  = ; &= nbsp; 'net_ldap_version' =3D> = 3,<br> &n= bsp; &nbs= p; = 'net_ldap_refcnt' =3D> = 1<br> &nb= sp;  = ; }, = 'Net::LDAP' = ),<br> &n= bsp; 'errorMessage' =3D> 'SSL connect attempt = failed error:14090086:SSL = routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify = failed'<br> &nb= sp; }, 'Net::LDAP::Extension' );<br>Can't locate = object method "search" via package "Net::LDAP::Bind" at <a = href=3D"http://department.pl/">department.pl</a> line 43, <DATA> = line 751.<br><br><br></div><div>So it clearly does not trust the = certificate. The certificate is in = /etc/ssl/certs/ca-bundle.trust.crt.<br><br></div><div>Any tips greatyl = appreciated.<br><br><br></div><div>--<br>Groeten,<br>natxo </div></div></div></div> </blockquote></div><br></div></div></body></html>= --Apple-Mail=_50E68457-BE73-4620-8A83-075396D0C438--