Problems connecting to 389 directory server

[Cantor, Scott]

> IIRC some openssl releases even
> called the connection insecure (or the chain invalid) if the
> "top-most" cert sent was self-signed (as would always be the case when
> sending the root CA cert).

No, it's actually the reverse. If the chain OpenSSL builds is rooted in a non-self-signed certificate, the verify routine fails. That bug still exists, AFAIK.

-- Scott