Bug 722961

Summary:	TLS_REQCERT=never ignored when the issuer certificate is expired
Product:	[Fedora] Fedora	Reporter:	Jan Vcelak <jvcelak>
Component:	openldap	Assignee:	Jan Vcelak <jvcelak>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	15	CC:	jvcelak, rmeggins, tsmetana
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	openldap-2.4.24-5.fc15	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:	722959	Environment:
Last Closed:	2011-11-17 23:42:30 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	722959
Bug Blocks:

Description Jan Vcelak 2011-07-18 15:40:37 UTC

+++ This bug was initially created as a clone of Bug #722959 +++

Description of problem:

Setting TLS_REQCERT=never is ignored, when the server certificate is before/after validity period. In that moment, connection fails.

Version-Release number of selected component (if applicable):

openldap-2.4.23-15.el6
openldap-2.4.24-3.fc15

How reproducible:

Set up certificates in slapd to allow TLS/SSL. The certificate can be invalid (invalid issuer, invalid server name, etc.).

Run: LDAPTLS_REQCERT=never ldapsearch -x -ZZ ...

The execution will be successful, TLS will be used.

Change your system time out of the validity period of the certificate. Run the same command again. The command will fail this time.

[root@rhel6-i686 ~]# date 010101012020
St led  1 01:01:00 CET 2020
[root@rhel6-i686 ~]# LDAPTLS_REQCERT=never ldapsearch -x -ZZ -d1
...
TLS: file slapd.pem does not end in [.0] - does not appear to be a CA certificate directory file with a properly hashed file name - skipping.
TLS: loaded CA certificate file /etc/openldap/cacerts/da4d55fe.0 from CA certificate directory /etc/openldap/cacerts.
TLS: certificate [E=root,CN=localhost.localdomain,OU=SomeOrganizationalUnit,O=SomeOrganization,L=SomeCity,ST=SomeState,C=--] is not valid - error -8181:Unknown code ___f 11.
TLS: certificate [E=root,CN=localhost.localdomain,OU=SomeOrganizationalUnit,O=SomeOrganization,L=SomeCity,ST=SomeState,C=--] is not valid - error -8162:Unknown code ___f 30.
TLS: certificate [E=root,CN=localhost.localdomain,OU=SomeOrganizationalUnit,O=SomeOrganization,L=SomeCity,ST=SomeState,C=--] is not valid - error -8162:Unknown code ___f 30.
TLS: error: connect - force handshake failure: errno 0 - moznss error -8162
TLS: can't connect: TLS error -8162:Unknown code ___f 30.
ldap_err2string
ldap_start_tls: Connect error (-11)
        additional info: TLS error -8162:Unknown code ___f 30

Additional info:

openldap-2.4.25-1.fc16 is not affected.

Comment 1 Jan Vcelak 2011-07-20 17:09:29 UTC

All versions of OpenLDAP with MozNSS are affected, see original bug 722959.

Patch submitted upstream: http://www.openldap.org/its/index.cgi?findid=6998

Comment 2 Fedora Update System 2011-08-24 19:39:26 UTC

openldap-2.4.24-4.fc15 has been submitted as an update for Fedora 15.
https://admin.fedoraproject.org/updates/openldap-2.4.24-4.fc15

Comment 3 Fedora Update System 2011-08-26 19:04:23 UTC

Package openldap-2.4.24-4.fc15:
* should fix your issue,
* was pushed to the Fedora 15 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing openldap-2.4.24-4.fc15'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/openldap-2.4.24-4.fc15
then log in and leave karma (feedback).

Comment 4 Fedora Update System 2011-09-12 19:02:32 UTC

openldap-2.4.24-5.fc15 has been submitted as an update for Fedora 15.
https://admin.fedoraproject.org/updates/openldap-2.4.24-5.fc15

Comment 5 Fedora Update System 2011-11-17 23:42:30 UTC

openldap-2.4.24-5.fc15 has been pushed to the Fedora 15 stable repository.  If problems still persist, please make note of it in this bug report.