![用于 LDAP 和证书的 TLS](https://linux22.com/image/662949/%E7%94%A8%E4%BA%8E%20LDAP%20%E5%92%8C%E8%AF%81%E4%B9%A6%E7%9A%84%20TLS.png)
我有 httpd 配置:
LoadModule ldap_module modules/mod_ldap.so
LoadModule ssl_module modules/mod_ssl.so
LDAPTrustedGlobalCert CA_BASE64 /etc/openldap/certs/domenCA.crt
<VirtualHost *:80>
ServerName domen.lan
ServerAlias domen domen1
DocumentRoot /var/www/html
<Directory /var/www/html/private1>
AuthName "Members only site"
AuthType basic
require valid-user
AuthBasicProvider ldap
AuthLDAPUrl "ldap://ldap.domen.lan/dc=domen,dc=lan"
# AuthLDAPUrl "ldap://ldap.domen.lan/dc=domen,dc=lan" TLS
</Directory>
</VirtualHost>
当我接下来运行并输入凭证时,它工作正常:
elinks http://domen.lan/private1
然后我尝试 TLS(相同,但 TLS 在行尾):
# AuthLDAPUrl "ldap://ldap.domen.lan/dc=domen,dc=lan"
AuthLDAPUrl "ldap://ldap.domen.lan/dc=domen,dc=lan" TLS
无法显示页面并且出现错误:
The server encountered an internal error or misconfiguration and was unable to complete your request.
在/var/log/httpd/access_log
:
"GET /private1 HTTP/1.1" 401 381 "-" "ELinks/0.12pre6 (textmode; Linux; 111x64-2)"
"GET /private1 HTTP/1.1" 500 527 "-" "ELinks/0.12pre6 (textmode; Linux; 111x64-2)"
沒有任何內容:
/var/log/messages
/var/log/httpd/error_log
当我跑步的时候
openssl s_client -connect domen.lan:389 -showcerts -state
我得到:
CONNECTED(00000003)
SSL_connect:before/connect initialization
SSL_connect:SSLv2/v3 write client hello A
140597450172320:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:184:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 249 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
---
我不知道如何修复该证书错误。
我有
centos 7.1
openldap-2.4.39-6.el7.x86_64
openldap-clients-2.4.39-6.el7.x86_64
openldap-servers-2.4.39-6.el7.x86_64
httpd-2.4.6-31.el7.centos.x86_64
TLS_REQCERT allow
如果我有,它似乎可以正常工作,etc/openldap/ldap.conf
但如果我有,它就不行TLS_REQCERT demand
。我不明白发生了什么:
TLS_CACERTDIR /etc/openldap/certs
SASL_NOCANON on
URI ldap://centos7s.domen.lan
BASE dc=domen,dc=lan
host centos7s.domen.lan
#TLS_REQCERT allow
TLS_REQCERT demand
ssl start_tls
TLS_CACERT /etc/openldap/certs/domenCA.crt
答案1
只需添加您自己的解决方案作为可读性的答案:
问题是我在创建证书时使用了不同的服务器名称,现在它不想接受该证书。因此,当我更正以下行时:
AuthLDAPUrl "ldap://ldap.domen.lan/dc=domen,dc=lan" TLS
证书中包含服务器名称,它就成功了!