Re: LDAPS connection failing with a "TLS accept failure error -1"

--001636b2b0e82f21ca048708b7fc
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Hi Dieter,

Thanks for the reply,

This server was only for testing purposes, so, that's why I used a
self-signed certificate.

I got it working, the issue, as stupid as it is, was that I was editing the
wrong ldap.conf file (Mac OSX has one on /etc/openldap and other on
/opt/local/etc/openldap, which was the one being used).

Marcelo.

On Thu, May 20, 2010 at 3:09 AM, Dieter Kluenter <[email protected]>wrote=
:

> Marcelo de Moraes Serpa <[email protected]> writes:
>
> > Hello all,
> >
> > I hope someone could help me -- I'm trying for almost one whole day
> already
> > and couldn't get LDAP over SSL to work, without success.
> [...]
> > I have generated a self-signed certificate using this command:
> >
> > sudo openssl req -newkey rsa:1024 -x509 -nodes -out server.pem -keyout
> > server.pem -days 3650
> [...]
>
> This is not the proper way to create a certificate chain.
> 1. create a certificate authority
> 2. create a server certificate
> 3. sign the server certificate with the CA
> 4. extract the password from server certificate into a key
>
> You may use tinyCA to create the chain
> http://tinyca.sm-zone.net/index.html
>
> -Dieter
>
> --
> Dieter Kl=FCnter | Systemberatung
> sip: +49.40.20932173
> http://www.dpunkt.de/buecher/2104.html
> GPG Key ID:8EF7B6C6
>

--001636b2b0e82f21ca048708b7fc
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Hi Dieter,<br><br>Thanks for the reply,<br><br>This server was only for tes=
ting purposes, so, that&#39;s why I used a self-signed certificate.<br><br>=
I got it working, the issue, as stupid as it is, was that I was editing the=
 wrong ldap.conf file (Mac OSX has one on /etc/openldap and other on /opt/l=
ocal/etc/openldap, which was the one being used).<br>
<br>Marcelo.<br><br><div class=3D"gmail_quote">On Thu, May 20, 2010 at 3:09=
 AM, Dieter Kluenter <span dir=3D"ltr">&lt;<a href=3D"mailto:dieter@dkluent=
er.de">[email protected]</a>&gt;</span> wrote:<br><blockquote class=3D"gm=
ail_quote" style=3D"margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(2=
04, 204, 204); padding-left: 1ex;">
<div class=3D"im">Marcelo de Moraes Serpa &lt;<a href=3D"mailto:celoserpa@g=
mail.com">[email protected]</a>&gt; writes:<br>
<br>
&gt; Hello all,<br>
&gt;<br>
&gt; I hope someone could help me -- I&#39;m trying for almost one whole da=
y already<br>
&gt; and couldn&#39;t get LDAP over SSL to work, without success.<br>
</div>[...]<br>
<div class=3D"im">&gt; I have generated a self-signed certificate using thi=
s command:<br>
&gt;<br>
&gt; sudo openssl req -newkey rsa:1024 -x509 -nodes -out server.pem -keyout=
<br>
&gt; server.pem -days 3650<br>
</div>[...]<br>
<br>
This is not the proper way to create a certificate chain.<br>
1. create a certificate authority<br>
2. create a server certificate<br>
3. sign the server certificate with the CA<br>
4. extract the password from server certificate into a key<br>
<br>
You may use tinyCA to create the chain<br>
<a href=3D"http://tinyca.sm-zone.net/index.html" target=3D"_blank">http://t=
inyca.sm-zone.net/index.html</a><br>
<br>
-Dieter<br>
<font color=3D"#888888"><br>
--<br>
Dieter Kl=FCnter | Systemberatung<br>
sip: +49.40.20932173<br>
<a href=3D"http://www.dpunkt.de/buecher/2104.html" target=3D"_blank">http:/=
/www.dpunkt.de/buecher/2104.html</a><br>
GPG Key ID:8EF7B6C6<br>
</font></blockquote></div><br>

--001636b2b0e82f21ca048708b7fc--