Currently /etc/openldap/ldap.conf has the following reference to CA store:
This is a specific store for openldap in openssl's nss certdir. By default this directory has an empty database.
# certutil -L -d /etc/openldap/certs/
Certificate Nickname Trust Attributes
ldapsearch and other utilities cannot be used to access ssl/startTLS servers with valid system wide trusted certificate chains.
ca-certificates package provide update-ca-trust utility to manage the system trust, for openssl it manages /etc/pki/tls/certs/ca-bundle.crt (/etc/ssl/certs which is symlink to /etc/pki/tls/certs), openldap uses openssl.
openldap package can be integrated to use this system wide store by adding the following into /etc/openldap/ldap.conf:
Or by updating ca-certificates package to also manage nss store in addition to openssl.
Integrating openldap into the system wide trust by default will enable easier and more secure management of system trust.
Fedora 22 changed to end-of-life (EOL) status on 2016-07-19. Fedora 22 is
no longer maintained, which means that it will not receive any further
security or bug fix updates. As a result we are closing this bug.
If you can reproduce this bug against a currently maintained version of
Fedora please feel free to reopen this bug against that version. If you
are unable to reopen this bug, please file a new report against the
current release. If you experience problems, please add a comment to this
Thank you for reporting this bug and we are sorry it could not be fixed.
This is correct. We should implement this (per https://fedoraproject.org/wiki/Features/SharedSystemCertificates). I am changing bug's version to RAWHIDE as it should not change already established defaults.
*** Bug 1352876 has been marked as a duplicate of this bug. ***
This bug appears to have been reported against 'rawhide' during the Fedora 26 development cycle.
Changing version to '26'.
*** Bug 1426177 has been marked as a duplicate of this bug. ***
This bug appears to have been reported against 'rawhide' during the Fedora 27 development cycle.
Changing version to '27'.