☰

LDAPS OpenLDAP Outlook 365

tag-icon • tag-icon ssl openldap
LDAPS OpenLDAP Outlook 365

当我尝试使用 Outlook 365 中的 SSL 连接到我的 openLDAP 服务（在 Ubuntu 18.04 上）时，我收到连接错误。当我尝试使用 LdapAdmin 客户端连接时，我能连接，也使用 SSL，但我收到“不受信任的证书”的警告。

在端口 636 上测试此操作OpenSSL -showcert，我得到以下输出（证书数据已删除）。我的链看起来不错（对我来说）。

有人能给我指出正确的方向吗？

CONNECTED(00000144)
depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA
verify error:num=19:self signed certificate in certificate chain
---
Certificate chain
 0 s:C = DE, ST = Example, L = Example, O = Example, CN = ldap.Example.de
   i:C = US, O = DigiCert Inc, CN = DigiCert SHA2 Secure Server CA
-----BEGIN CERTIFICATE-----
MIIHSDCCBjCgAwIBAgIQDl1qcjCl3eK6YxOqO4W98zANBgkqhkiG9w0BAQsFADBN
...
EoMrMT5ArQyW5wdS5S8k1FaQ5XtHwWW3L6pAtcDW9i3/rUQRVrqqmkIwtBY=
-----END CERTIFICATE-----
 1 s:C = US, O = DigiCert Inc, CN = DigiCert SHA2 Secure Server CA
   i:C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA
-----BEGIN CERTIFICATE-----
MIIElDCCA3ygAwIBAgIQAf2j627KdciIQ4tyS8+8kTANBgkqhkiG9w0BAQsFADBh
...
j6tJLp07kzQoH3jOlOrHvdPJbRzeXDLz
-----END CERTIFICATE-----
 2 s:C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA
   i:C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA
-----BEGIN CERTIFICATE-----
MIIDrzCCApegAwIBAgIQCDvgVpBCRrGhdWrJWZHHSjANBgkqhkiG9w0BAQUFADBh
...
CAUw7C29C79Fv1C5qfPrmAESrciIxpg0X40KPMbp1ZWVbd4=
-----END CERTIFICATE-----
---
Server certificate
subject=C = DE, ST = Example, L = Example, O = Example, CN = ldap.Example.de
 issuer=C = US, O = DigiCert Inc, CN = DigiCert SHA2 Secure Server CA

---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 4762 bytes and written 447 bytes
Verification error: self signed certificate in certificate chain
---
New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 4096 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384
    Session-ID: 10A01A15EF18ADC670E8A67448B1B1CB0C34E444523F862331CCC4BBAAD7D05C
    Session-ID-ctx:
    Master-Key: 06A3BB95671AF2277F9DDB9FD0E3E2076E79B9583B8D04159A1ABFF8B59C9DB75DDF80BA14A0F47D561E60074300D9F9
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1559732770
    Timeout   : 7200 (sec)
    Verify return code: 19 (self signed certificate in certificate chain)
    Extended master secret: yes
---

答案1

您的链中的服务器证书是自签名证书，其 CN 包含“example.de”，看起来像一个示例（只要您不管理 ldap.Example.de）。

s:C = DE, ST = Example, L = Example, O = Example, CN = ldap.Example.de

只需将其删除并使用正确颁发的证书（并且不要忘记附加完整的证书链）。

相关内容