https://bugzilla.novell.com/show_bug.cgi?id=689456 https://bugzilla.novell.com/show_bug.cgi?id=689456#c1 Wolfgang Rosenauer changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |wolfgang@rosenauer.org --- Comment #1 from Wolfgang Rosenauer 2011-04-27 12:20:56 UTC --- Had the same issue. Peer certificate verification is by default enabled which causes this. Either the default setting should be changed or an option is needed in YaST since I expect it to work if I do everything using YaST (especially using a "common server certificate"). -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=689456 https://bugzilla.novell.com/show_bug.cgi?id=689456#c3 Jiří­ Suchomel changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jsuchome@novell.com AssignedTo|bnc-team-screening@forge.pr |rhafer@novell.com |ovo.novell.com | --- Comment #3 from Jiří­ Suchomel 2011-04-27 19:12:42 UTC --- Could you attach /etc/ldap.conf and /etc/openldap/ldap.conf? Ralf, is it known situation? What solution we offer? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=689456 https://bugzilla.novell.com/show_bug.cgi?id=689456#c Ralf Haferkamp changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=689456 https://bugzilla.novell.com/show_bug.cgi?id=689456#c6 Peter Martinovic changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |ASSIGNED CC| |peter@martinovic.sk InfoProvider|wolfgang@rosenauer.org | --- Comment #6 from Peter Martinovic 2011-05-15 15:04:26 UTC --- Hello, it seems that the problem is that the server certificate key file generated by yast (/etc/ssl/servercerts/serverkey.pem) is not readable by the ldap user account. To fix it I copied the files /etc/ssl/certs/YaST-CA.pem /etc/ssl/servercerts/servercert.pem /etc/ssl/servercerts/serverkey.pem to /etc/openldap/certs/ca.pem /etc/openldap/certs/servercert.pem /etc/openldap/certs/serverkey.pem and made them owned by root.ldap chown root.ldap /etc/openldap/certs/* and made them readable by ldap group chmod g+r /etc/openldap/certs/* I edited the following config files (according to http://www.openldap.org/doc/admin23/tls.html#TLS Certificates) /etc/openldap/ldap.conf: tls_cacert /etc/openldap/certs/ca.pem /etc/openldap/slapd.conf: TLSCACertificateFile /etc/openldap/certs/ca.pem TLSCertificateFile /etc/openldap/certs/servercert.pem TLSCertificateKeyFile /etc/openldap/certs/serverkey.pem I also edited /etc/ldap.conf (is this necessary?): tls_cacertfile /etc/openldap/certs/ca.cert The LDAP TLS seems to work fine now (verified by Yast Ldap Browser). Other possibility would be to set the user rights directly on /etc/ssl/servercerts/serverkey.pem but I did not consider it to be a cleaner solution. Cheers, Peter -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=689456 https://bugzilla.novell.com/show_bug.cgi?id=689456#c8 --- Comment #8 from Peter Martinovic 2011-05-15 18:32:36 UTC --- Sorry to spam this issue. I must confirm that I was wrong in my first comment. The problem is that the config lines were not created by yast, not the user rights. Please be so kind and delete my comments. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=689456 https://bugzilla.novell.com/show_bug.cgi?id=689456#c10 Ralf Haferkamp changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |RESOLVED InfoProvider|wolfgang@rosenauer.org | Resolution| |NORESPONSE --- Comment #10 from Ralf Haferkamp 2011-06-22 15:18:10 CEST --- The requested information was not provided. Closing as "NORESPONSE". Feel free to reopen when you can supply the requested information. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.