Re: How to force openldap to use TLSv1?

On 17/02/2010 23:39, huican wrote:
> As I read the Mozilla LDAP C SDK Programmer's Guide at:
> http://www.mozilla.org/directory/csdk-docs/ssl.htm#how_ssl_works_with_ldap,
> It says: "The Mozilla LDAP C SDK only supports SSL 3.0 and does not
> support the Start Transport Layer Security (TLS) Operation."

the docs are outdated in this regard, LDAP StartTLS extended
operation is supported, see

http://mxr.mozilla.org/mozilla/source/directory/c-sdk/ldap/include/ldap_ssl.h#75
http://mxr.mozilla.org/mozilla/source/directory/c-sdk/ldap/clients/tools/common.c#1142

> Does it means the current ldap c-sdk not supporting TLSv1?
> If it is the case, is there any milestone to support TLSv1?

you are mixing up TLSv1 standard with LDAP StartTLS extended
operation. both are supported. for more details see

https://developer.mozilla.org/en/Glossary#TLS
http://www.ietf.org/rfc/rfc2830.txt

the rest of your questions related to openldap
server configiration should be directed to an
appropriate openldap mailing list/s.