Bug 689456

Had the same issue. Peer certificate verification is by default enabled which causes this. Either the default setting should be changed or an option is needed in YaST since I expect it to work if I do everything using YaST (especially using a "common server certificate").

rpm -q yast2-ldap-client
yast2-ldap-client-2.20.14.1-0.3.1.noarch

Could you attach /etc/ldap.conf and /etc/openldap/ldap.conf?

Ralf, is it known situation? What solution we offer?

oxlive:/etc/ssl/certs # grep -Ev "^#|^$" /etc/ldap.conf
base    dc=ox,dc=rosenauer,dc=org
bind_policy     soft
pam_lookup_policy       yes
pam_password    exop
nss_initgroups_ignoreusers      root,ldap
nss_schema      rfc2307bis
nss_map_attribute       uniqueMember member
ssl     start_tls
uri     ldap://127.0.0.1
ldap_version    3
pam_filter      objectClass=posixAccount

oxlive:/etc/ssl/certs # grep -Ev "^#|^$" /etc/openldap/ldap.conf
host    localhost
base    dc=ox,dc=rosenauer,dc=org

Hm, I am not able to reproduce this problem on my test system. When I am testing this yast2-ldap-client always correctly creates the correct tls_cacert* options in /etc/ldap.conf /etc/openldap/ldap.conf and /etc/sssd/sssd.conf. In your case they are clearly missing. Can you give some more detailed steps how you setup your system and when exactly you get that error message (I was using the steps from the initial  bug description)?

There is however a glitch in the sssd.conf and /etc/ldap.conf as created by yast2-ldap-client. It uses the IP Address 127.0.0.1 instead of "localhost" this will make certificate verification fail as well (unless you have 127.0.0.1 as a "Subject Alt Name" in your server certificate, which doesn't make any sense). But the failure message should be different to yours (something about not matching hostname and CN-Attribute).

Hello,

it seems that the problem is that the server certificate key file generated by yast (/etc/ssl/servercerts/serverkey.pem) is not readable by the ldap user account.

To fix it I copied the files
/etc/ssl/certs/YaST-CA.pem
/etc/ssl/servercerts/servercert.pem
/etc/ssl/servercerts/serverkey.pem
to
/etc/openldap/certs/ca.pem
/etc/openldap/certs/servercert.pem
/etc/openldap/certs/serverkey.pem

and made them owned by root.ldap
chown root.ldap /etc/openldap/certs/*

and made them readable by ldap group
chmod g+r /etc/openldap/certs/*

I edited the following config files
(according to http://www.openldap.org/doc/admin23/tls.html#TLS Certificates)

/etc/openldap/ldap.conf:
tls_cacert      /etc/openldap/certs/ca.pem

/etc/openldap/slapd.conf:
TLSCACertificateFile /etc/openldap/certs/ca.pem
TLSCertificateFile /etc/openldap/certs/servercert.pem
TLSCertificateKeyFile /etc/openldap/certs/serverkey.pem

I also edited /etc/ldap.conf (is this necessary?):
tls_cacertfile /etc/openldap/certs/ca.cert

The LDAP TLS seems to work fine now (verified by Yast Ldap Browser).


Other possibility would be to set the user rights directly on /etc/ssl/servercerts/serverkey.pem but I did not consider it to be a cleaner solution.


Cheers,

Peter

Ehm, I maybe was wrong :-) The other reason of course could be that the TLS* lines were not created in the conf files by yast.

Sorry to spam this issue. I must confirm that I was wrong in my first comment. The problem is that the config lines were not created by yast, not the user rights. Please be so kind and delete my comments.

Setting back to NEEDINFO to get the info requested in comment#5.

The requested information was not provided. Closing as "NORESPONSE". Feel free to reopen when you can supply the requested information.