after upgrading Stretch to Buster authnz-ldap/mod-ldap is unable to connect to 2012R2 AD with ldaps.
This is my configuration:
#Must be set to a low value to permit failover from a server to the other.
LDAPConnectionTimeout 1
LDAPRetries 1
# SSL
LDAPVerifyServerCert on
LDAPTrustedMode SSL
LDAPTrustedGlobalCert CA_BASE64 /etc/apache2/ssl/ca_der.cer
#LDAP SERVERS DECLARATION START
<AuthnProviderAlias ldap MyLDAPS>
AuthLDAPBindDN "CN=svc-otp,CN=Users,DC=otp,DC=local"
AuthLDAPBindPassword REDACTED #checked and working
# Search user
AuthLDAPURL "ldaps://ad03.otp.local/CN=Users,DC=otp,DC=local?userPrincipalName?sub?(&(memberOf:1.2.840.113556.1.4.1941:=CN=Admins,OU=2FA,OU=PCI,DC=otp,DC=local)(objectClass=user))"
</AuthnProviderAlias>
<LocationMatch /manage >
# Using this to bind
AuthType Basic
AuthName "USE YOUR user@domain ACCOUNT"
AuthBasicProvider MyLDAPS
require valid-user
</LocationMatch>
I tried openssl s_client -connect ad03.otp.local:636 -state -nbio
which resulted in
CONNECTED(00000003)
Turned on non blocking io
SSL_connect:before SSL initialization
SSL_connect:SSLv3/TLS write client hello
SSL_connect:error in SSLv3/TLS write client hello
write R BLOCK
SSL_connect:error in SSLv3/TLS write client hello
read:errno=104
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 306 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
then I discovered that /etc/ssl/openssl.conf added
[system_default_sect]
MinProtocol = TLSv1.2
CipherString = DEFAULT@SECLEVEL=2
I commented both lines and the openssl s_client worked as it worked on Stretch.
But Apache always complain that it can't connect...
I googled a lot around similar problems and Apache docs but did not found a hint or solution.
I don't understand yet why but it seems that LDAPTrustedGlobalCert CA_BASE64 /etc/apache2/ssl/ca_der.cer
is not read.
I added the CA cert from Active Directory in /etc/ssl/certs/
and rerun update-ca-certificates
and ldapsearch worked. apache mod_ldap worked also.
Usefull commands:
openssl s_client -showcerts -connect ad03.otp.local:636
openssl s_client -connect ad03.otp.local:636 -state -nbio
The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.