LDAPS connection failing with a "TLS accept failure error -1"

Marcelo de Moraes Serpa <[email protected]> Tue, 18 May 2010 22:53:05 -0500
Newsgroups gmane.network.openldap.general
Message-ID <[email protected]>
--0016e68de981401d1d0486ea65c1
Content-Type: text/plain; charset=ISO-8859-1

Hello all,

I hope someone could help me -- I'm trying for almost one whole day already
and couldn't get LDAP over SSL to work, without success.

The objective is to setup a development box for testing purposes, so, the
simpler the better, however, it must be as simple as needed only.

I've followed this tutorial:
http://islandlinux.org/howto/installing-secure-ldap-openldap-ssl-ubuntu-using-self-signed-certificate.
I'm on Mac OSX Snow Leopard, though.

slapd version: @(#) $OpenLDAP: slapd 2.4.11 (Feb 11 2010 02:23:14)
//Installed from MacPorts

I have generated a self-signed certificate using this command:

sudo openssl req -newkey rsa:1024 -x509 -nodes -out server.pem -keyout
server.pem -days 3650

I've set the Common Name to "localhost".

The configuration files look like this (non-relevanted parts snipped):

slapd.conf:

TLSCipherSuite HIGH:MEDIUM:-SSLv2
TLSCACertificateFile /Users/myuser/Sandbox/server.pem
TLSCertificateFile /Users/myuser/Sandbox/server.pem
TLSCertificateKeyFile /Users/myuser/Sandbox/server.pem

TLSVerifyUser never

ldap.conf

BASE dc=mycompany,dc=com
URI  ldaps://localhost/
TLS_REQCERT never

I'm starting slapd with the following command:

sudo /usr/libexec/slapd -f /opt/local/etc/openldap/slapd.conf -d1 -h
"ldaps:///"

And testing the connection with the following:

ldapsearch  -H ldaps://localhost -d255

When running ldapsearch, I get the following as output:

ldap_create
> ldap_url_parse_ext(ldaps://localhost)
> ldap_pvt_sasl_getmech
> ldap_search
> put_filter: "(objectclass=*)"
> put_filter: simple
> put_simple_filter: "objectclass=*"
> ldap_build_search_req ATTRS:
>     supportedSASLMechanisms
> ldap_send_initial_request
> ldap_new_connection 1 1 0
> ldap_int_open_connection
> ldap_connect_to_host: TCP localhost:636
> ldap_new_socket: 3
> ldap_prepare_socket: 3
> ldap_connect_to_host: Trying ::1 636
> ldap_connect_timeout: fd: 3 tm: -1 async: 0
> TLS trace: SSL_connect:before/connect initialization
> tls_write: want=124, written=124
>   0000:  80 7a 01 03 01 00 51 00  00 00 20 00 00 39 00 00   .z....Q...
> ..9..
>   0010:  38 00 00 35 00 00 16 00  00 13 00 00 0a 07 00 c0
> 8..5............
>   0020:  00 00 33 00 00 32 00 00  2f 00 00 07 05 00 80 03
> ..3..2../.......
>   0030:  00 80 00 00 05 00 00 04  01 00 80 00 00 15 00 00
> ................
>   0040:  12 00 00 09 06 00 40 00  00 14 00 00 11 00 00 08
> ......@.........
>   0050:  00 00 06 04 00 80 00 00  03 02 00 80 0c e4 9d 98
> ................
>   0060:  c1 ad 36 d0 88 fb 6b 92  32 a0 ce 22 63 82 99 3b
> ..6...k.2.."c..;
>   0070:  3b 3d 03 03 38 05 d0 a1  30 2d 9f d2
> ;=..8...0-..
> TLS trace: SSL_connect:SSLv2/v3 write client hello A
> tls_read: want=7, got=0
>
> TLS: can't connect.
> ldap_perror
> ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1)
>

As you can see, it fails with the "TLS: can't connect" error message. Not
that obvious. I then switch to the terminal that has slapd running on the
fg, and I see the following:

(snip)
connection_get(13): got connid=0
connection_read(13): checking for input on id=0
*connection_read(13): TLS accept failure error=-1 id=0, closing*
connection_closing: readying conn=0 sd=13 for close
connection_close: conn=0 sd=13

What I don't understand is why it is failing if I've set both sides to
ignore certificates. What am I doing wrong?

Marcelo.

--0016e68de981401d1d0486ea65c1
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Hello all,<br><br>I hope someone could help me -- I&#39;m trying for almost=
 one whole day already and couldn&#39;t get LDAP over SSL to work, without =
success.<br><br>The objective is to setup a development box for testing pur=
poses, so, the simpler the better, however, it must be as simple as needed =
only.<br>
<br>I&#39;ve followed this tutorial: <a href=3D"http://islandlinux.org/howt=
o/installing-secure-ldap-openldap-ssl-ubuntu-using-self-signed-certificate"=
>http://islandlinux.org/howto/installing-secure-ldap-openldap-ssl-ubuntu-us=
ing-self-signed-certificate</a>. I&#39;m on Mac OSX Snow Leopard, though.<b=
r>
<br>slapd version: @(#) $OpenLDAP: slapd 2.4.11 (Feb 11 2010 02:23:14) //In=
stalled from MacPorts<br><br>I have generated a self-signed certificate usi=
ng this command:<br><br><code>sudo openssl req -newkey rsa:1024 -x509 -node=
s -out server.pem=20
-keyout server.pem -days 3650</code><br><br>I&#39;ve set the Common Name to=
 &quot;localhost&quot;.<br><br>The configuration files look like this (non-=
relevanted parts snipped):<br><br>slapd.conf:<br><br>TLSCipherSuite HIGH:ME=
DIUM:-SSLv2<br>

TLSCACertificateFile  /Users/myuser/Sandbox/server.pem<br>
TLSCertificateFile    /Users/myuser/Sandbox/server.pem<br>
TLSCertificateKeyFile /Users/myuser/Sandbox/server.pem<br><br>TLSVerifyUser=
 never<br><br>ldap.conf<br><br>BASE dc=3Dmycompany,dc=3Dcom<br>URI=A0 ldaps=
://localhost/<br>TLS_REQCERT never<br><br>I&#39;m starting slapd with the f=
ollowing command:<br>
<br>sudo /usr/libexec/slapd -f /opt/local/etc/openldap/slapd.conf -d1 -h &q=
uot;ldaps:///&quot;<br><br>And testing the connection with the following:<b=
r><br>ldapsearch=A0 -H ldaps://localhost -d255<br><br>When running ldapsear=
ch, I get the following as output:<br>
<br><blockquote style=3D"margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid =
rgb(204, 204, 204); padding-left: 1ex;" class=3D"gmail_quote">ldap_create<b=
r>ldap_url_parse_ext(ldaps://localhost)<br>ldap_pvt_sasl_getmech<br>ldap_se=
arch<br>
put_filter: &quot;(objectclass=3D*)&quot;<br>put_filter: simple<br>put_simp=
le_filter: &quot;objectclass=3D*&quot;<br>ldap_build_search_req ATTRS:<br>=
=A0=A0=A0 supportedSASLMechanisms<br>ldap_send_initial_request<br>ldap_new_=
connection 1 1 0<br>
ldap_int_open_connection<br>ldap_connect_to_host: TCP localhost:636<br>ldap=
_new_socket: 3<br>ldap_prepare_socket: 3<br>ldap_connect_to_host: Trying ::=
1 636<br>ldap_connect_timeout: fd: 3 tm: -1 async: 0<br>TLS trace: SSL_conn=
ect:before/connect initialization<br>
tls_write: want=3D124, written=3D124<br>=A0 0000:=A0 80 7a 01 03 01 00 51 0=
0=A0 00 00 20 00 00 39 00 00=A0=A0 .z....Q... ..9..=A0 <br>=A0 0010:=A0 38 =
00 00 35 00 00 16 00=A0 00 13 00 00 0a 07 00 c0=A0=A0 8..5............=A0 <=
br>=A0 0020:=A0 00 00 33 00 00 32 00 00=A0 2f 00 00 07 05 00 80 03=A0=A0 ..=
3..2../.......=A0 <br>
=A0 0030:=A0 00 80 00 00 05 00 00 04=A0 01 00 80 00 00 15 00 00=A0=A0 .....=
...........=A0 <br>=A0 0040:=A0 12 00 00 09 06 00 40 00=A0 00 14 00 00 11 0=
0 00 08=A0=A0 ......@.........=A0 <br>=A0 0050:=A0 00 00 06 04 00 80 00 00=
=A0 03 02 00 80 0c e4 9d 98=A0=A0 ................=A0 <br>
=A0 0060:=A0 c1 ad 36 d0 88 fb 6b 92=A0 32 a0 ce 22 63 82 99 3b=A0=A0 ..6..=
.k.2..&quot;c..;=A0 <br>=A0 0070:=A0 3b 3d 03 03 38 05 d0 a1=A0 30 2d 9f d2=
=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 ;=3D..8...0-..=A0=A0=A0=A0=A0 <b=
r>TLS trace: SSL_connect:SSLv2/v3 write client hello A<br>
tls_read: want=3D7, got=3D0<br><br>TLS: can&#39;t connect.<br>ldap_perror<b=
r>ldap_sasl_interactive_bind_s: Can&#39;t contact LDAP server (-1)<br></blo=
ckquote><br>As you can see, it fails with the &quot;TLS: can&#39;t connect&=
quot; error message. Not that obvious. I then switch to the terminal that h=
as slapd running on the fg, and I see the following:<br>
<br>(snip)<br>connection_get(13): got connid=3D0<br>connection_read(13): ch=
ecking for input on id=3D0<br><b>connection_read(13): TLS accept failure er=
ror=3D-1 id=3D0, closing</b><br>connection_closing: readying conn=3D0 sd=3D=
13 for close<br>
connection_close: conn=3D0 sd=3D13<br><br>What I don&#39;t understand is wh=
y it is failing if I&#39;ve set both sides to ignore certificates. What am =
I doing wrong?<br><br>Marcelo.<br><br><br>

--0016e68de981401d1d0486ea65c1--