Hide Forgot
Description of problem: Many customers have certificate issues when using the System Security Services Daemon. However, the debug logs are of no use because the openldap libraries do not return useful error messages explaining the cause of the failure. This is in turn caused by the mozilla-nss libraries not returning these messages to openldap. (Note: this should be viewed as a regression in SSSD and openldap because the openldap libraries that used openssl for crypto reported this information in a useful way). Without this information, it is very difficult for customers to identify where their problems are located. Version-Release number of selected component (if applicable): nss-3.12.10-11.el6 How reproducible: Every time Steps to Reproduce: 1. Configure SSSD to talk to an LDAP server with a server certificate issued by a private CA (that is not in the standard CA list). 2. Attempt to use SSSD over a secure channel (ldaps or ldap_id_use_start_tls = true) 3. The debug logs will report that an error occurred, whose message is "unknown". Actual results: "Unknown" error message in the logs Expected results: The logs should identify that the error was caused by an invalid certificate chain. Additional info: As mentioned above, this worked properly until openldap converted to mozilla-nss. Related upstream ticket for openldap: http://www.openldap.org/its/index.cgi/Incoming?id=6789
*** Bug 736866 has been marked as a duplicate of this bug. ***
It would actually be a lot easier and risk-free to rebase to NSS 3.13.
Will be fixed automatically once we upgrade to a version of NSS that has the fix for https://bugzilla.mozilla.org/show_bug.cgi?id=172051
Since RHEL 6.2 External Beta has begun, and this bug remains unresolved, it has been rejected as it is not proposed as exception or blocker. Red Hat invites you to ask your support representative to propose this request, if appropriate and relevant, in the next release of Red Hat Enterprise Linux.
This bug should be closed as we updated to upstream nss-3.13 which the release that added the support for localizable error strings. That update occurred at the start of the year.