Created attachment 615685 [details]
Full text output of the installation and configuration of an openldap server, a detailed description of the problem, and details of how to work around it

Description of problem:

Openldap server will ignore openssl certificates and keys if a mozilla/nss cert/key db exists in /etc/openldap/certs.

When installing and configuring openldap for the first time, if you attempt to use certificate files as opposed to certificates that are managed in a mozilla/nss cert/key db, upon establishing an ssl/tls connection to the server, the openldap server will ignore these files and attempt to open the moznss cert/key db anyway.

Version-Release number of selected component (if applicable):

openldap-servers-2.4.23-26.el6_3.2.i686 on RHEL 6.3

How reproducible:
every time

Steps to Reproduce:
(this is a summary.  The full steps I took to set up the openldap server, reproduce the problem, and work around it are attached).

1. install openldap-servers
2. basic server configuration:
 - configure suffix
 - set olcrootpw for cn=manager
 - set olcTLSCertificateFile, olcTLSCertificateKeyFile, olcTLSCACertificateFile
3. restart server.
4. openssl s_client -connect localhost:636 -showcerts


Actual results:
# openssl s_client -connect localhost:636 -showcerts
CONNECTED(00000003)
*nothing more appears -- the server hangs here*

Expected results:
# openssl s_client -connect localhost:636 -showcerts
CONNECTED(00000003)
depth=0 C = XX, L = Default City, O = Default Company Ltd, CN = centos6.example.org
verify error:num=18:self signed certificate
verify return:1
depth=0 C = XX, L = Default City, O = Default Company Ltd, CN = centos6.example.org
[snip, snip]

Additional info:
How to work around (yes this is not the 'Right Thing To Do'(tm) but it demonstrates the problem):
1. cd /etc/openldap/certs
2. mv cert8.db key3.db /tmp/
3. service slapd restart