Krdytkyu

Configuring StartTLS for OpenLDAP.

• Ubuntu server 16.04


• Slapd 2.4.42+dfsg-2ubuntu3.2

I have my own internal Certificate authority that is providing certificates.

I have set up certificates and key:
in /etc/ssl/certs:

-rw-r----- 1 root ssl-cert   3268 Jul 14 23:02 ldaptest.roenix.net.cert.pem



lrwxrwxrwx 1 root root         51 Jul  2 13:22 roenix.ca.cert.pem -> /usr/local/share/ca-certificates/roenix.ca.cert.crt

in /etc/ssl/private:

-rw-r----- 1 root ssl-cert 3243 Jul 14 23:01 ldaptest.roenix.net.key.pem

I have correctly set hostname:

@ldaptest:/etc/ssl/certs$ hostname -f

ldaptest.roenix.net

I try to add the configuration to slapd with this LDIF:

dn: cn=config

changetype: modify

add: olcTLSCACertificateFile

olcTLSCACertificateFile: /etc/ssl/certs/roenix.ca.cert.pem

-

add: olcTLSCertificateFile

olcTLSCertificateFile: /etc/ssl/certs/ldaptest.roenix.net.cert.pem

-

add: olcTLSCertificateKeyFile

olcTLSCertificateKeyFile: /etc/ssl/private/ldaptest.roenix.net.key.pem

With the command:

sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f certinfo.ldif

I get this error:

SASL/EXTERNAL authentication started

SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth

SASL SSF: 0

modifying entry "cn=config"

ldap_modify: Other (e.g., implementation specific) error (80)

Any help greatly appreciated!

i had the same problem.
Certificates were stored in the /opt/local/cert.

You must add this directory to the list of the resolved files in /etc/apparmor.d/usr.sbin.slapd:

/opt/local/cert/ r,`

/opt/local/cert/* r,

I solved this problem by changing the order in the file.ldif like this:

dn: cn=config

changetype: modify

replace: olcTLSCertificateKeyFile

olcTLSCertificateKeyFile: /etc/openldap/certs/your_key

dn: cn=config

changetype: modify

replace: olcTLSCertificateFile

olcTLSCertificateFile: /etc/openldap/certs/your_certificate

and the I launched the command ldapmodify -Y EXTERNAL -H ldapi:/// -f your_file.ldif
make sure that there an acl that makes the root eligible to make change with authenticating with SASL bind.

To make sure that changes have been done launch this command ldapsearch -Y EXTERNAL -H ldapi:/// -b cn=config | grep olcTLS