+++ This bug was initially created as a clone of Bug #722959 +++ Description of problem: Setting TLS_REQCERT=never is ignored, when the server certificate is before/after validity period. In that moment, connection fails. Version-Release number of selected component (if applicable): openldap-2.4.23-15.el6 openldap-2.4.24-3.fc15 How reproducible: Set up certificates in slapd to allow TLS/SSL. The certificate can be invalid (invalid issuer, invalid server name, etc.). Run: LDAPTLS_REQCERT=never ldapsearch -x -ZZ ... The execution will be successful, TLS will be used. Change your system time out of the validity period of the certificate. Run the same command again. The command will fail this time. [root@rhel6-i686 ~]# date 010101012020 St led 1 01:01:00 CET 2020 [root@rhel6-i686 ~]# LDAPTLS_REQCERT=never ldapsearch -x -ZZ -d1 ... TLS: file slapd.pem does not end in [.0] - does not appear to be a CA certificate directory file with a properly hashed file name - skipping. TLS: loaded CA certificate file /etc/openldap/cacerts/da4d55fe.0 from CA certificate directory /etc/openldap/cacerts. TLS: certificate [E=root,CN=localhost.localdomain,OU=SomeOrganizationalUnit,O=SomeOrganization,L=SomeCity,ST=SomeState,C=--] is not valid - error -8181:Unknown code ___f 11. TLS: certificate [E=root,CN=localhost.localdomain,OU=SomeOrganizationalUnit,O=SomeOrganization,L=SomeCity,ST=SomeState,C=--] is not valid - error -8162:Unknown code ___f 30. TLS: certificate [E=root,CN=localhost.localdomain,OU=SomeOrganizationalUnit,O=SomeOrganization,L=SomeCity,ST=SomeState,C=--] is not valid - error -8162:Unknown code ___f 30. TLS: error: connect - force handshake failure: errno 0 - moznss error -8162 TLS: can't connect: TLS error -8162:Unknown code ___f 30. ldap_err2string ldap_start_tls: Connect error (-11) additional info: TLS error -8162:Unknown code ___f 30 Additional info: openldap-2.4.25-1.fc16 is not affected.
All versions of OpenLDAP with MozNSS are affected, see original bug 722959. Patch submitted upstream: http://www.openldap.org/its/index.cgi?findid=6998
openldap-2.4.24-4.fc15 has been submitted as an update for Fedora 15. https://admin.fedoraproject.org/updates/openldap-2.4.24-4.fc15
Package openldap-2.4.24-4.fc15: * should fix your issue, * was pushed to the Fedora 15 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing openldap-2.4.24-4.fc15' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/openldap-2.4.24-4.fc15 then log in and leave karma (feedback).
openldap-2.4.24-5.fc15 has been submitted as an update for Fedora 15. https://admin.fedoraproject.org/updates/openldap-2.4.24-5.fc15
openldap-2.4.24-5.fc15 has been pushed to the Fedora 15 stable repository. If problems still persist, please make note of it in this bug report.