Could not start TLS encryption

General support questions
Post Reply
golden3
Posts: 50
Joined: 2014/07/22 05:55:42

Could not start TLS encryption

Post by golden3 » 2015/02/09 10:57:51

Hello Guys,

I have configured the openldap directory server , now i'm trying to login the test user via client machine , I'm facing the below error message from /var/log/messages
can any one help to get away from the below error .

localhost sssd [be[default]] :Could not start TLS encryption. TLS error -1872 : Peer's certificate issuer has been marked as not trusted by the user.

Thanks & Regards
Golden John S

aks
Posts: 2558
Joined: 2014/09/20 11:22:14

Re: Could not start TLS encryption

Post by aks » 2015/02/09 17:29:15

That just means that the certificate presented is NOT trusted by your certificate store, so it's pointless setting up a SSL transaction. Either add the CA's certificate (of the CA whom minted the certificate) or run LDAP without the certificate trust bit (if you can, you may not be able to as it is a bad idea from a security perspective).
If it's a self signed certificate, google for self signed certificate and openldap.

golden3
Posts: 50
Joined: 2014/07/22 05:55:42

Re: Could not start TLS encryption

Post by golden3 » 2015/03/30 08:55:52

Self signed certificated are created without any issues, But the problem shown in : /var/log/messages/

Could not start TLS encryption. TLS error -8172: Peers's certificate issuer has been marked as not trusted by the user.


kindly give some remedy .

User avatar
TrevorH
Forum Moderator
Posts: 23906
Joined: 2009/09/24 10:40:56
Location: Brighton, UK

Re: Could not start TLS encryption

Post by TrevorH » 2015/03/30 09:51:52

You have to add the CA certificate that signed the LDAP server's cert to the client. The default location is in /etc/openldap/certs so copy your CA cert in there and then you have to create a symlink to it that is named after the c_hash of the cert. Run /etc/pki/tls/misc/c_hash /etc/openldap/certs/ca.crt and it will tell you an 8 digit hex number and you have to create a symlink called that 8 digit number.0 pointing to the ca.crt file.
CentOS 5 died in March 2017 - migrate NOW!
Full time Geek, part time moderator. Use the FAQ Luke

golden3
Posts: 50
Joined: 2014/07/22 05:55:42

Re: Could not start TLS encryption

Post by golden3 » 2015/03/31 10:15:15

when i try to put the above command its showing the below error,

Error opening Certificate /etc/openldap/certs/ca.crt
139995926329160:error:02001002:system library:fopen:No such file or directory:bss_file.c:398:fopen('/etc/openldap/certs/ca.crt','r')
139995926329160:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:400:
unable to load certificate
.0 => /etc/openldap/certs/ca.crt


can you give some remedy .

User avatar
TrevorH
Forum Moderator
Posts: 23906
Joined: 2009/09/24 10:40:56
Location: Brighton, UK

Re: Could not start TLS encryption

Post by TrevorH » 2015/03/31 11:06:45

Did you copy your CA cert into that directory first? Did you call it the same name as the example I used in the command?
CentOS 5 died in March 2017 - migrate NOW!
Full time Geek, part time moderator. Use the FAQ Luke

aks
Posts: 2558
Joined: 2014/09/20 11:22:14

Re: Could not start TLS encryption

Post by aks » 2015/03/31 19:09:45

Have you checked permissions and/or selinux contexts on the file?

Post Reply