I started by creating a self-signed certificate as follows:
I have installed OpenLDAP on Rocky 9.6 and everything works until I try to convert to LDAPS and I cannot find any clear instructions. I started by creating a self-signed certificate
# Sets our cert path and information
# The "CertificateFile" has to be set to the hostname of the LDAP server
dn: cn=config
changetype: modify
replace: olcTLSCACertificatePath
olcTLSCACertificatePath: /etc/openldap/ldap.conf
-
replace: olcTLSCACertificateFile
olcTLSCACertificateFile: /etc/openldap/certs/ca.pem
-
replace: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/openldap/certs/ldap1.key
-
replace: olcTLSCertificateFile
olcTLSCertificateFile: /etc/openldap/certs/ldap1.pem
dn: olcDatabase={2}mdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=example,dc=computing
# Adding a rootDN for the config.
# Note that this isn't fully necessary as you can use -Y EXTERNAL -H ldapi:/// instead
# So, treat this as an optional thing. If you do want it, consider a different password.
dn: olcDatabase={2}mdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=Manager,dc=example,dc=computing
# Set the password again in the mdb database
# This is because sometimes the password set when making the database doesn't 'work'
dn: olcDatabase={2}mdb,cn=config
changetype: modify
replace: olcRootPW
olcRootPW: {SSHA}fKR87as2UOchc4xj7FwKmxHxxxxx
# Sets the default password hash to SSHA -- Refer to the 'bug' information if this does not work
dn: olcDatabase={-1}frontend,cn=config
changetype: modify
replace: olcPasswordHash
olcPasswordHash: {SSHA}
dn: olcDatabase={1}monitor,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth"
I tried to add this using: ldapmodify -Y EXTERNAL -H ldapi:/// -f certs.ldif but just get errors?
Is there any reason for using OpenLDAP instead of say for example iDM or ipa-server as it’s known? This would have SSL/TLS enabled by default. It also has a nice webui as well for managing and maintaining.
The error isn’t about the certificates themselves. 80 refers to an implementation error. This can be numerous things such as:
The order of modifications for ldapmodify/ldapadd
The order in which some attributes are added/modified actually matter
Rare: Permissions of the working directories (e.g. /etc/openldap/slapd.d)
Extremely rare: selinux can stop it (check with audit2why if you are unsure)
Before blaming permissions or selinux, you may want to change the order in which you are trying to make changes to your initial openldap configuration and also verify the configuration you are trying to put in is valid.
What you’re trying to set for olcTLSCACertificatePath is not valid. You cannot point to a conf file. You must point to a directory, e.g. /etc/openldap/certs.
Pointing directly to a CA file may be unnecessary, but if you need to use it, then you can set it. However, I would try without it and stick to setting a valid olcTLSCACertificatePath.
There may be cases where you need to change the order of these. You may find that the CA certificate has to be last or you may find that the cert key has to come before the cert file. You will need to determine this for yourself.
It also seems that you are likely referencing this page for this setup. I would take a look at this page also for smaller examples.
Hi,
Thanks for your help. I don’t know where the typo came from but it did not help so I tried breaking the requests up into smaller files and that seems to get me further:
[root@ldap1 ~]# cat 1.ldif
dn: cn=config
changetype: modify
replace: olcTLSVerifyClient
olcTLSVerifyClient: never
[root@ldap1 ~]# cat 2.ldif
# Sets our cert path and information
# The "CertificateFile" has to be set to the hostname of the LDAP server
dn: cn=config
changetype: modify
replace: olcTLSCACertificatePath
olcTLSCACertificatePath: /etc/openldap/certs
[root@ldap1 ~]# cat 2.ldif
# Sets our cert path and information
# The "CertificateFile" has to be set to the hostname of the LDAP server
dn: cn=config
changetype: modify
replace: olcTLSCACertificatePath
olcTLSCACertificatePath: /etc/openldap/certs
I continued breaking them up and it worked until I got to number five:
[root@ldap1 ~]# cat 3.ldif
# Sets our cert path and information
# The "CertificateFile" has to be set to the hostname of the LDAP server
dn: cn=config
changetype: modify
replace: olcTLSCACertificatePath
olcTLSCACertificatePath: /etc/openldap/certs
-
replace: olcTLSCACertificateFile
olcTLSCACertificateFile: /etc/openldap/certs/ca.pem
[root@ldap1 ~]# cat 4.ldif
# Sets our cert path and information
# The "CertificateFile" has to be set to the hostname of the LDAP server
dn: cn=config
changetype: modify
replace: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/openldap/certs/ldap1.key
[root@ldap1 ~]# cat 5.ldif
# Sets our cert path and information
# The "CertificateFile" has to be set to the hostname of the LDAP server
dn: cn=config
changetype: modify
replace: olcTLSCertificateFile
olcTLSCertificateFile: /etc/openldap/certs/ldap1.pem
It looks as though I have another typo but can’t see it?
I have solved it by experimenting with add and replace. The problem was you have to ensure you have ALL the config in the database before anything will work: