I'm setting up an internal ticketing system that queries Active Directory. Plain LDAP works, but I want to encrypt the connection with LDAPS. I exported a certificate from Active Directory Certificate Services, copied it to the Linux host, renamed it from .cer to .crt, placed it in /usr/local/share/ca-certificates/, and ran update-ca-certificates successfully. However, testing with `openssl s_client -connect my.server.dc:636 -showcerts` reports errors 20 and 21: "unable to get local issuer certificate" and "unable to verify the first certificate." What certificates or client settings are missing?
3 Answers
The OpenLDAP client may not use the system CA bundle automatically. Configure its TLS CA path in the client configuration, such as `TLS_CACERT` or `TLS_CACERTDIR` in `ldap.conf`. If using a CA directory, place the PEM CA certificate there and run `openssl rehash` so OpenLDAP can find it. Then test against the fully qualified hostname listed in the certificate’s SAN, not just an alternate name or IP address.
The Linux host probably does not trust the certificate chain being presented by the domain controller. Install the issuing root CA and any intermediate CA certificates in the Linux trust store, rather than importing only the domain controller’s leaf certificate. Make sure they are PEM-formatted and run the appropriate trust-store update afterward.
The usual chain is the root CA, the intermediate CA if one exists, and then the server certificate. The client needs to trust the CA certificates; the server presents its own certificate and normally the required intermediate certificates.
Also verify that the certificate is actually Base64 PEM and that the file contains the expected `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` markers. Renaming a binary DER certificate to `.crt` does not convert its format. Check the certificate’s issuer, subject, validity dates, and SAN entries with `openssl x509 -in file.crt -noout -text`.
The Authority Information Access section of the server certificate can indicate where the issuing CA certificate is published. Use that information to obtain the missing intermediate or root certificate, then add the appropriate CA certificates to the client trust configuration.