using a chain cert with LDAP connector?

[Cameron Kerr]

Potentially your LDAP server is offering the ca chain in the wrong order. 

If you do something like the following:

openssl s_client -showcerts -connect yourldapserver:636 </dev/null

then you'll see the chain offered by the LDAPS server. If you take the subject and issuer lines of each certificate, they should be adjacent, start with the host cert and end at some point closer to the root where there should be no problem for clients to trust.

Cheers,
Cameron 

Sent from my iPhone

> On 25/03/2014, at 7:04 am, "Cantor, Scott" <cantor.2 at osu.edu> wrote:
> 
>> On 3/24/14, 1:54 PM, "Liam Hoekenga" <liamr at umich.edu> wrote:
>> 
>> Looks like I need one file with all of the certs in the chain (the cert
>> for the LDAP server, intermediary CA, and the top level root CA).
> 
> That would mean the LDAP server is misconfigured, and it's also dangerous
> because it means you're trusting things inadvertently below the root
> (which if that's the intent, should mean you should directly trust the
> end-entity cert alone).
> 
> -- Scott
> 
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net