Re: Openldap 2.4.48-1 vs my company's pki

[David Goldberg <dsg18096 at gmail dot com>]

One downside of having to do non-work email on my phone while at work is
that I didn't realize my reply to Quanah was direct, not to the list.
Sorry about that.  Trying again:

I did the following to try to answer

$ ldd /usr/bin/ldapsearch.exe # 2.4.42

        ntdll.dll => /cygdrive/c/WINDOWS/SYSTEM32/ntdll.dll (0x7ffc58b50000)

        KERNEL32.DLL => /cygdrive/c/WINDOWS/System32/KERNEL32.DLL
(0x7ffc57bd0000)

        KERNELBASE.dll => /cygdrive/c/WINDOWS/System32/KERNELBASE.dll
(0x7ffc554b0000)

        SYSFER.DLL => /cygdrive/c/WINDOWS/System32/SYSFER.DLL (0x59e30000)

        ADVAPI32.dll => /cygdrive/c/WINDOWS/System32/ADVAPI32.dll
(0x7ffc57b20000)

        msvcrt.dll => /cygdrive/c/WINDOWS/System32/msvcrt.dll
(0x7ffc57950000)

        sechost.dll => /cygdrive/c/WINDOWS/System32/sechost.dll
(0x7ffc563a0000)

        RPCRT4.dll => /cygdrive/c/WINDOWS/System32/RPCRT4.dll
(0x7ffc581d0000)

        cygwin1.dll => /usr/bin/cygwin1.dll (0x180040000)

        cyglber-2-4-2.dll => /usr/bin/cyglber-2-4-2.dll (0x3fbd60000)

        cygsasl2-3.dll => /usr/bin/cygsasl2-3.dll (0x3faae0000)

        cygldap-2-4-2.dll => /usr/bin/cygldap-2-4-2.dll (0x3fb9b0000)

        cygcrypto-1.0.0.dll => /usr/bin/cygcrypto-1.0.0.dll (0x3fe480000)

        cygz.dll => /usr/bin/cygz.dll (0x3fa000000)

        cygssl-1.0.0.dll => /usr/bin/cygssl-1.0.0.dll (0x3fa860000)

And

$ ldd /usr/bin/ldapsearch.exe # 2.4.48

        ntdll.dll => /cygdrive/c/WINDOWS/SYSTEM32/ntdll.dll (0x7ffc58b50000)

        KERNEL32.DLL => /cygdrive/c/WINDOWS/System32/KERNEL32.DLL
(0x7ffc57bd0000)

        KERNELBASE.dll => /cygdrive/c/WINDOWS/System32/KERNELBASE.dll
(0x7ffc554b0000)

        SYSFER.DLL => /cygdrive/c/WINDOWS/System32/SYSFER.DLL (0x59e30000)

        ADVAPI32.dll => /cygdrive/c/WINDOWS/System32/ADVAPI32.dll
(0x7ffc57b20000)

        msvcrt.dll => /cygdrive/c/WINDOWS/System32/msvcrt.dll
(0x7ffc57950000)

        sechost.dll => /cygdrive/c/WINDOWS/System32/sechost.dll
(0x7ffc563a0000)

        RPCRT4.dll => /cygdrive/c/WINDOWS/System32/RPCRT4.dll
(0x7ffc581d0000)

        cygwin1.dll => /usr/bin/cygwin1.dll (0x180040000)

        cyglber-2-4-2.dll => /usr/bin/cyglber-2-4-2.dll (0x3fbd60000)

        cygsasl2-3.dll => /usr/bin/cygsasl2-3.dll (0x3faae0000)

        cygldap-2-4-2.dll => /usr/bin/cygldap-2-4-2.dll (0x3fb9b0000)

        cygssl-1.1.dll => /usr/bin/cygssl-1.1.dll (0x3fa7d0000)

        ??? => ??? (0xe80000)

        cygcrypto-1.1.dll => /usr/bin/cygcrypto-1.1.dll (0x3fe210000)

        cygz.dll => /usr/bin/cygz.dll (0x3fa000000)

So something seems weird with one showing cygssl 1.1 and maybe something
missing while the working one shows cygssl 1.0.  any idea how I might
resolve that?

Thanks
-- 
Dave Goldberg
dsg18096@gmail.com


On Fri, Aug 2, 2019 at 1:28 PM Quanah Gibson-Mount <quanah@symas.com> wrote:

> --On Friday, August 02, 2019 12:45 PM -0400 David Goldberg
> <dsg18096@gmail.com> wrote:
>
> > I updated openldap from 2.4.42-1 to 2.4.48-1 this morning and now
> > ldapsearch will not connect, complaining that the server provided
> > certificate is self signed. I have set up /etc/pki with my company's
> > certificate chain and that allows 2.4.42-1 (and earlier) and other
> > applications to properly authenticate local services. What has changed in
> > 2.4.48-1 that causes this to not work and how can I fix it. I've
> > downgraded for now; that is not a good long term solution of course.
>
> What SSL library is being used for each of the two builds (I.e., gnutls?
> openssl? moznss?)  What SSL library version did 2.4.42 link to?  What SSL
> library version does 2.4.48 link to?  Generally OpenLDAP should be linked
> to OpenSSL which uses PEM formatted certificates.  Also check whether you
> have a global ldap.conf file (usually something like
> /etc/openldap/ldap.conf or /etc/ldap.conf, etc, depending on how OpenLDAP
> was built) that defines where to find the CA Cert(s), or a ~user/.ldaprc,
> etc.  OpenLDAP client utilities generally by default do not search for a
> global list of CA certificates.
>
> --Quanah
>
> --
>
> Quanah Gibson-Mount
> Product Architect
> Symas Corporation
> Packaged, certified, and supported LDAP solutions powered by OpenLDAP:
> <http://www.symas.com>
>
>

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple