Steven Jones wrote:
Is this correct/expected?
vuwunicvdebian1:/etc/ldap# ldapsearch -x -ZZ '(uid=jonesst1)'
ldap_start_tls: Connect error (-11)
additional info: Start TLS request accepted.Server willing to
negotiate SSL.
vuwunicvdebian1:/etc/ldap#
On the server I check check the access log for "startTLS" and see it,
[14/Sep/2007:13:08:08 +1200] conn=39 fd=67 slot=67 connection from
130.195.87.235 to 130.195.87.249
[14/Sep/2007:13:08:08 +1200] conn=39 op=0 EXT
oid="1.3.6.1.4.1.1466.20037" name="startTLS"
[14/Sep/2007:13:08:08 +1200] conn=39 op=0 RESULT err=0 tag=120
nentries=0 etime=0
[14/Sep/2007:13:08:08 +1200] conn=39 op=-1 fd=67 closed - Encountered
end of file.
But the "Connect error (-11)" concerns me.
I think this can happen if the server cert does not have a subject DN
that starts with
cn=foo.example.com, where
foo.example.com is the FQDN
of the directory server machine. Or, the server cert has a subject DN
like this:
cn=foo.example.com,....
and the client either cannot resolve (via DNS or /etc/hosts or whatever
it says in the /etc/nsswitch.conf file)
foo.example.com, or the reverse
DNS lookup on the server's IP address does not resolve to
foo.example.com
Regards
Steven
--
Fedora-directory-users mailing list
Fedora-directory-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-directory-users