I think I've solved the problem. It was my self-signed CA, TinyCA. It
seems to be incapable of adding the SAN.
I switched to XCA and it signed with the SAN. Replaced the cert on pro02,
and now we are replicating again over LDAPS.
Thanks again for the quick response and suggestions!
On Wed, Jul 20, 2022 at 9:12 AM Pierre Rogier <progier(a)redhat.com> wrote:
I can think about several possibilities:
 the value of nsslapd-validate-cert config attribute may have changed
(i.e: now the certificate chain is verified while it was not the case
Turning off nsslapd-validate-cert should then solve the issue.
 DNS resolution issue: i.e: fully qualified hostname associated
with the supplier ip address differs on both machines (But upgrading RHDS
should not impact the DNS resolution ... )
 Problem in the way the certificate gets generated ...
certutil -L -d /etc/dirsrv/slapd-*inst* [name] is your
friend to display the certificate(s).
Good luck !
On Tue, Jul 19, 2022 at 9:52 PM Brian Collins <rbriancollins(a)gmail.com>
> Good day,
> We have an LDAP cluster on RHEL 8. We were
> running 18.104.22.168-1.module_el8+13163+e27841f7.x86_64 and recently updated
> to 2.0.15-1.module_el8+14185+adb3f555.x86_64.
> Since then, replication fails from any server to any other server. What
> I am seeing in /var/log/dirsrv/slapd-pro01/errors is:
> [19/Jul/2022:15:20:20.174222661 -0400] - ERR - NSMMReplicationPlugin -
> bind_and_check_pwp - agmt="cn=pro01topro02" (pro02:636) - Replication bind
> with SIMPLE auth failed: LDAP error -1 (Can't contact LDAP server) (TLS:
> hostname does not match subjectAltName in peer certificate)
> [19/Jul/2022:15:46:41.092806631 -0400] - ERR - slapi_ldap_bind - Could
> not send bind request for id [cn=replication manager,cn=config]
> authentication mechanism [SIMPLE]: error -1 (Can't contact LDAP server),
> system error -5987 (Invalid function argument.), network error 0 (Unknown
> error, host "pro02.example.com:636")
> I regenerated and reinstalled the certs for pro01 and pro02, adding the
> SAN. But that did not help things any.
> Did I miss something in the update to v2?
> Thanks in advance,
> Brian Collins
> 389-users mailing list -- 389-users(a)lists.fedoraproject.org
> To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org
> Fedora Code of Conduct:
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> Do not reply to spam on the list, report it:
389 Directory Server Development Team
389-users mailing list -- 389-users(a)lists.fedoraproject.org
To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org
Fedora Code of Conduct:
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
Do not reply to spam on the list, report it: