我刚刚按照以下说明设置了 Openldap
http://www.computerglitch.net/bin/texts/CentOS6_LDAP.php
正常连接返回预期的内容，但 tls 测试却挂起。
知道我做错了什么吗？我花了一天半的时间在网上搜索答案，但还没有找到遇到类似问题的人。
这是调试输出的列表。
[root@alderaan openldap]# ldapsearch -v -d1023 -x -b "dc=alderaan,dc=com" -ZZ
ldap_initialize( <DEFAULT> )
ldap_create
ldap_extended_operation_s
ldap_extended_operation
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP localhost:389
ldap_new_socket: 3
ldap_prepare_socket: 3
ldap_connect_to_host: Trying ::1 389
ldap_pvt_connect: fd: 3 tm: -1 async: 0
ldap_open_defconn: successful
ldap_send_server_request
ber_scanf fmt ({it) ber:
ber_dump: buf=0x227a9b0 ptr=0x227a9b0 end=0x227a9cf len=31
0000: 30 1d 02 01 01 77 18 80 16 31 2e 33 2e 36 2e 31 0....w...1.3.6.1
0010: 2e 34 2e 31 2e 31 34 36 36 2e 32 30 30 33 37 .4.1.1466.20037
ber_scanf fmt ({) ber:
ber_dump: buf=0x227a9b0 ptr=0x227a9b5 end=0x227a9cf len=26
0000: 77 18 80 16 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e w...1.3.6.1.4.1.
0010: 31 34 36 36 2e 32 30 30 33 37 1466.20037
ber_flush2: 31 bytes to sd 3
0000: 30 1d 02 01 01 77 18 80 16 31 2e 33 2e 36 2e 31 0....w...1.3.6.1
0010: 2e 34 2e 31 2e 31 34 36 36 2e 32 30 30 33 37 .4.1.1466.20037
ldap_write: want=31, written=31
0000: 30 1d 02 01 01 77 18 80 16 31 2e 33 2e 36 2e 31 0....w...1.3.6.1
0010: 2e 34 2e 31 2e 31 34 36 36 2e 32 30 30 33 37 .4.1.1466.20037
ldap_result ld 0x2271170 msgid 1
wait4msg ld 0x2271170 msgid 1 (infinite timeout)
wait4msg continue ld 0x2271170 msgid 1 all 1
** ld 0x2271170 Connections:
* host: localhost port: 389 (default)
refcnt: 2 status: Connected
last used: Mon Feb 11 03:52:44 2013
** ld 0x2271170 Outstanding Requests:
* msgid 1, origid 1, status InProgress
outstanding referrals 0, parent count 0
ld 0x2271170 request count 1 (abandoned 0)
** ld 0x2271170 Response Queue:
Empty
ld 0x2271170 response count 0
ldap_chkResponseList ld 0x2271170 msgid 1 all 1
ldap_chkResponseList returns ld 0x2271170 NULL
ldap_int_select
read1msg: ld 0x2271170 msgid 1 all 1
ber_get_next
ldap_read: want=8, got=8
0000: 30 0c 02 01 01 78 07 0a 0....x..
ldap_read: want=6, got=6
0000: 01 00 04 00 04 00 ......
ber_get_next: tag 0x30 len 12 contents:
ber_dump: buf=0x227be60 ptr=0x227be60 end=0x227be6c len=12
0000: 02 01 01 78 07 0a 01 00 04 00 04 00 ...x........
read1msg: ld 0x2271170 msgid 1 message type extended-result
ber_scanf fmt ({eAA) ber:
ber_dump: buf=0x227be60 ptr=0x227be63 end=0x227be6c len=9
0000: 78 07 0a 01 00 04 00 04 00 x........
read1msg: ld 0x2271170 0 new referrals
read1msg: mark request completed, ld 0x2271170 msgid 1
request done: ld 0x2271170 msgid 1
res_errno: 0, res_error: <>, res_matched: <>
ldap_free_request (origid 1, msgid 1)
ldap_parse_extended_result
ber_scanf fmt ({eAA) ber:
ber_dump: buf=0x227be60 ptr=0x227be63 end=0x227be6c len=9
0000: 78 07 0a 01 00 04 00 04 00 x........
ldap_parse_result
ber_scanf fmt ({iAA) ber:
ber_dump: buf=0x227be60 ptr=0x227be63 end=0x227be6c len=9
0000: 78 07 0a 01 00 04 00 04 00 x........
ber_scanf fmt (}) ber:
ber_dump: buf=0x227be60 ptr=0x227be6c end=0x227be6c len=0
ldap_msgfree
TLS: using moznss security dir /etc/openldap/certs prefix .
TLS: loaded CA certificate file /etc/pki/tls/certs/slapdcert.pem.
tls_write: want=70, written=70
0000: 16 03 01 00 41 01 00 00 3d 03 01 51 18 b1 5c a5 ....A...=..Q..\.
0010: 86 c7 5f 91 80 97 ca 40 fc a8 6a 63 34 b5 f0 7b [email protected]..{
0020: ad 95 f3 c7 4c 45 d1 c8 57 60 da 00 00 16 00 ff ....LE..W`......
0030: 00 35 00 04 00 05 00 2f 00 0a 00 09 00 64 00 62 .5...../.....d.b
0040: 00 03 00 06 01 00 ......
跑完步之后。
ln -s /etc/pki/tls/certs/slapdcert.pem `openssl x509 -noout -hash -in /etc/pki/tls/certs/slapdcert.pem`
我现在得到以下输出。
ldapsearch -x -d1023 -b "dc=alderaan,dc=com" -ZZ
ldap_create
ldap_extended_operation_s
ldap_extended_operation
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP localhost:389
ldap_new_socket: 3
ldap_prepare_socket: 3
ldap_connect_to_host: Trying ::1 389
ldap_pvt_connect: fd: 3 tm: -1 async: 0
ldap_open_defconn: successful
ldap_send_server_request
ber_scanf fmt ({it) ber:
ber_dump: buf=0x11009e0 ptr=0x11009e0 end=0x11009ff len=31
0000: 30 1d 02 01 01 77 18 80 16 31 2e 33 2e 36 2e 31 0....w...1.3.6.1
0010: 2e 34 2e 31 2e 31 34 36 36 2e 32 30 30 33 37 .4.1.1466.20037
ber_scanf fmt ({) ber:
ber_dump: buf=0x11009e0 ptr=0x11009e5 end=0x11009ff len=26
0000: 77 18 80 16 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e w...1.3.6.1.4.1.
0010: 31 34 36 36 2e 32 30 30 33 37 1466.20037
ber_flush2: 31 bytes to sd 3
0000: 30 1d 02 01 01 77 18 80 16 31 2e 33 2e 36 2e 31 0....w...1.3.6.1
0010: 2e 34 2e 31 2e 31 34 36 36 2e 32 30 30 33 37 .4.1.1466.20037
ldap_write: want=31, written=31
0000: 30 1d 02 01 01 77 18 80 16 31 2e 33 2e 36 2e 31 0....w...1.3.6.1
0010: 2e 34 2e 31 2e 31 34 36 36 2e 32 30 30 33 37 .4.1.1466.20037
ldap_result ld 0x10f7170 msgid 1
wait4msg ld 0x10f7170 msgid 1 (infinite timeout)
wait4msg continue ld 0x10f7170 msgid 1 all 1
** ld 0x10f7170 Connections:
* host: localhost port: 389 (default)
refcnt: 2 status: Connected
last used: Mon Feb 11 06:06:00 2013
** ld 0x10f7170 Outstanding Requests:
* msgid 1, origid 1, status InProgress
outstanding referrals 0, parent count 0
ld 0x10f7170 request count 1 (abandoned 0)
** ld 0x10f7170 Response Queue:
Empty
ld 0x10f7170 response count 0
ldap_chkResponseList ld 0x10f7170 msgid 1 all 1
ldap_chkResponseList returns ld 0x10f7170 NULL
ldap_int_select
使用 -H ldaps://192.168.1.25:636
ldapsearch -x -d1023 -H ldaps://192.168.1.25:636 -b "dc=alderaan,dc=com" objective=*
ldap_url_parse_ext(ldaps://192.168.1.25:636)
ldap_create
ldap_url_parse_ext(ldaps://192.168.1.25:636/??base)
ldap_sasl_bind
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP 192.168.1.25:636
ldap_new_socket: 3
ldap_prepare_socket: 3
ldap_connect_to_host: Trying 192.168.1.25:636
ldap_pvt_connect: fd: 3 tm: -1 async: 0
TLS: loaded CA certificate file /etc/pki/tls/certs/slapdcert.pem.
tls_write: want=70, written=70
0000: 16 03 01 00 41 01 00 00 3d 03 01 51 18 d3 e6 56 ....A...=..Q...V
0010: 13 d6 44 8b 38 50 c3 8f 07 b3 4f fc e4 c2 81 1a ..D.8P....O.....
0020: a9 71 8b 94 2e 32 a9 82 fa 4b f2 00 00 16 00 ff .q...2...K......
0030: 00 35 00 04 00 05 00 2f 00 0a 00 09 00 64 00 62 .5...../.....d.b
0040: 00 03 00 06 01 00 ......
答案1
您是否已将证书符号链接到其散列值？即：
ln -s /etc/ssl/certs/server.pem `openssl x509 -noout -hash -in /etc/ssl/certs/server.pem`
如果您有中级证书，您也需要为此/它们这样做。
如果您仍然遇到问题，您可以运行：
openssl s_client -connect <ldapserver_name_or_ip>:636
并粘贴输出（假设 openldap 正在监听端口 636）。
假设您的证书是：
/etc/pki/tls/certs/slapdcert.pem
然后你可以运行：
ln -s /etc/pki/tls/certs/slapdcert.pem `openssl x509 -noout -hash -in /etc/pki/tls/certs/slapdcert.pem`
请注意，openssl 命令是反引号（~ 键上的反引号），而不是单引号。
答案2
如果您运行，strace -e file,network ldapsearch ...您是否看到正在读取证书？还可以使用 WireShark 进行网络捕获，看看 TLS 隧道是否已建立。