Red Hat Bugzilla – Bug 1563080
libldap tlsmc continue even after it fails to extract CA certificate [rhel-7.5.z]
Last modified: 2018-07-18 22:21:41 EDT
This bug has been copied from bug #1547922 and has been proposed to be backported to 7.5 z-stream (EUS).
The test with upgrade from RHEL-7.3 proved that the issue was mitigated. During the upgrade the server certificate files in tmp directory could not been created, but the temporary certificate directory was not lefty in inconsistent state so manual restart of the slapd daemon restored the service. # rpm -q openldap openldap-2.4.40-13.el7.x86_64 # yum update ... %< ... ---> Package openldap.x86_64 0:2.4.40-13.el7 will be updated ---> Package openldap.x86_64 0:2.4.44-16.el7 will be an update ---> Package openldap-clients.x86_64 0:2.4.40-13.el7 will be updated ---> Package openldap-clients.x86_64 0:2.4.44-16.el7 will be an update ---> Package openldap-servers.x86_64 0:2.4.40-13.el7 will be updated ---> Package openldap-servers.x86_64 0:2.4.44-16.el7 will be an update ... %< ... Complete! # rpm -q openldap openldap-2.4.44-16.el7.x86_64 # # # ll /tmp/openldap-tlsmc-certs--2DFC65D7E76F2B10A5D1B751E42AB3C7A11D1DD635A2F8AF767FCF5AD8EDA4EB/cacerts/ total 4 -r--------. 1 ldap ldap 1522 Apr 12 02:29 cert0.pem # ldapsearch -ZZ -H ldap://my-domain.com -x '*'ldap_start_tls: Can't contact LDAP server (-1) # # ps -ef |grep slapd root 25352 17318 0 03:08 pts/0 00:00:00 grep --color=auto slapd # service slapd restart Redirecting to /bin/systemctl restart slapd.service # ll /tmp/openldap-tlsmc-certs--2DFC65D7E76F2B10A5D1B751E42AB3C7A11D1DD635A2F8AF767FCF5AD8EDA4EB/cacerts/ total 12 lrwxrwxrwx. 1 ldap ldap 9 Apr 12 03:08 1c3035cc.0 -> cert2.pem lrwxrwxrwx. 1 ldap ldap 9 Apr 12 03:08 82204446.0 -> cert0.pem lrwxrwxrwx. 1 ldap ldap 9 Apr 12 03:08 be4aa8c4.0 -> cert1.pem -r--------. 1 ldap ldap 1522 Apr 12 03:08 cert0.pem -r--------. 1 ldap ldap 1559 Apr 12 03:08 cert1.pem -r--------. 1 ldap ldap 1578 Apr 12 03:08 cert2.pem # # ldapsearch -LLL -ZZ -H ldap://my-domain.com -x dn: dc=my-domain,dc=com objectClass: dcObject objectClass: organization dc: my-domain o: my-domain description: my-domain
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:1389