I am unable to figure out how instances #1 and #2 differ.
Instance #1 has long-established supplier-agreements (using both LDAPS and STARTTLS) with
other instances of 389-Directory. So I know instance #1 can function correctly as a
supplier. Instance #3 demonstrates it can be a consumer when supplied by instance #2. I
can perform LDAPS and STARTTLS queries from a.state.ak.us to instance #3, so I know it is
listening on the network and not blocked by a host-based firewall.
Any suggestions of where to look, or config-attributes to check, would be appreciated.
The first check would be from on the host instance #1:
openssl s_client -connect hostname-of-instance-two:636 -showcerts
And assert that the connection proceeds and the certificate chain presented is as you
expect.
--
Sincerely,
William Brown
Senior Software Engineer,
Identity and Access Management
SUSE Labs, Australia