The scenario:
- You’re using CentOS 7 or RHEL 7.
- You’re using OpenLDAP.
- You have TLS set up on OpenLDAP.
- You are trying to perform a query against the server using
ldapsearch.
Problem #1:
You get:
ldap_start_tls: Can't contact LDAP server (-1)
ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)
Possible solution:
You’re using the -Z option (along with -h and -p) to specify the host and port and request TLS. That option doesn’t work.
Instead, just use the -H option and specify the parameters as an LDAPS URL.
For example:
ldapsearch -x -Z -h localhost -p 636 -b 'dc=example' '(objectClass=*)'
becomes:
ldapsearch -x -H ldaps://localhost:636/ -b 'dc=example' '(objectClass=*)'
This is actually mentioned on the OpenLDAP FAQ if you look hard enough:
Most clients now have a -Z flag which enables sending the StartTLS extended operation to the server. This extended operation initiates TLS negotiation. To use ldaps://, one must use -H ldaps://.
(Emphasis mine.) I’ve no idea what -Z is for, given that it isn’t needed if you use -H with an LDAPS URL, and doesn’t work if you don’t.
Problem 2:
Having worked out how to request a TLS connection, it still doesn’t work, so you try adding the -d 1 argument to turn on some debugging. In the client’s debug logs you see either:
TLS: error: tlsm_PR_Recv returned 0 - error 21:Is a directory
or
TLS: error: tlsm_PR_Recv returned 0 - error 13:Permission denied
Solution:
You probably have SELinux enabled. OpenLDAP doesn’t work with SELinux. Disable it and reboot the server, or work out how to persuade SELinux to let openldap open its own config files.