Problems connecting to 389 directory server

[Peter Schober]

* Phil Pishioneri <pgp at pSu.edu> [2017-12-05 20:39]:
> I don't believe that including the root CA (aka trust anchor) is
> incorrect. From RFC 5246 (TLS 1.2), section 7.4.2 ("Server Certificate")
> -- https://tools.ietf.org/html/rfc5246#section-7.4.2
> 
>     certificate_list
>           This is a sequence (chain) of certificates.  The sender's
>           certificate MUST come first in the list.  Each following
>           certificate MUST directly certify the one preceding it.  Because
>           certificate validation requires that root keys be distributed
>           independently, the self-signed certificate that specifies the root
>           certificate authority MAY be omitted from the chain, under the
>           assumption that the remote end must already possess it in order to
>           validate it in any case

Funny. I wonder how they imagine validation of /anything/ would work
if the assumption made at the end could also be wrong (it's just an
assumption, after all).
If OTOH it is always required for the "remote end" to have a copy of
the root CA cert for any of this to make sense sending the self-signed
cert provides no security at all.  IIRC some openssl releases even
called the connection insecure (or the chain invalid) if the
"top-most" cert sent was self-signed (as would always be the case when
sending the root CA cert).

-peter