dsconf works fine for instances using ldaps in v1.4.2 (389-directory-server:stable) bit it seems to be broken (not recognizing TLS certificates) in v1.4.3 for the commands like
dsconf ldaps://ldap-model.polytechnique.fr:636 -D "cn=Directory Manager" -w mypass some_command
In both cases i am using dsconf to manage the same external LDAP server (1.4.3.x), the OS on both is CentOS 8.2 with latest updates:
<With version 1.4.2>
[root@ldap-centos8 ~]# rpm -qa | grep 389
[root@ldap-centos8 ~]# dnf -y module enable 389-directory-server:stable
[root@ldap-centos8 ~]# dnf -y install 389-ds-base
[root@ldap-centos8 ~]# rpm -qa | grep 389
python3-lib389-1.4.2.16-1.module_el8+9435+e6daf39f.noarch
389-ds-base-libs-1.4.2.16-1.module_el8+9435+e6daf39f.x86_64
389-ds-base-1.4.2.16-1.module_el8+9435+e6daf39f.x86_64
[root@ldap-centos8 ~]# dsconf ldaps://ldap-model.polytechnique.fr:636 -D "cn=Directory Manager" -w mypass security get
nsslapd-security: on
nsslapd-securelistenhost:
nsslapd-secureport: 636
...
<everything's fine>
<Now the version 1.4.3>
[root@ldap-centos8 ~]# dnf -y remove 389*
[root@ldap-centos8 ~]# dnf -y module disable 389-directory-server:stable
[root@ldap-centos8 ~]# dnf -y module enable 389-directory-server:testing
[root@ldap-centos8 ~]# dnf -y install 389-ds-base
[root@ldap-centos8 ~]# rpm -qa | grep 389
python3-lib389-1.4.3.13-1.module_el8+10475+b74bca99.noarch
389-ds-base-libs-1.4.3.13-1.module_el8+10475+b74bca99.x86_64
389-ds-base-1.4.3.13-1.module_el8+10475+b74bca99.x86_64
[root@ldap-centos8 ~]# dsconf ldaps://ldap-model.polytechnique.fr:636 -D "cn=Directory Manager" -w mypass security get
Error: Can't contact LDAP server - error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed (self signed certificate in certificate chain)
<dsconf does not seem to recongize the server's certificate it recognized in 1.4.2 even if ldapsearch still works ok>
[root@ldap-centos8 ~]# ldapsearch -H ldaps://ldap-model.polytechnique.fr -b 'cn=config' -D "cn=Directory Manager" -W '(cn=config)' nsslapd-security
Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base <cn=config> with scope subtree
# filter: (cn=config)
# requesting: nsslapd-security
#
# config
dn: cn=config
nsslapd-security: on
...
<dsconf -v for both cases>
[root@ldap-centos8 ~]# dsconf -v ldaps://ldap-model.polytechnique.fr:636 -D "cn=Directory Manager" -w mypass security get
DEBUG: The 389 Directory Server Configuration Tool
DEBUG: Inspired by works of: ITS, The University of Adelaide
DEBUG: dsrc path: /root/.dsrc
DEBUG: dsrc container path: /data/config/container.inf
DEBUG: dsrc instances: []
DEBUG: dsrc no such section: slapd-ldaps://ldap-model.polytechnique.fr:636
DEBUG: Called with: Namespace(basedn=None, binddn='cn=Directory Manager', bindpw='mypass', func=<function _security_generic_get_parser.<locals>.<lambda> at 0x7fce5a5e7158>, instance='ldaps://ldap-model.polytechnique.fr:636', json=False, prompt=False, pwdfile=None, starttls=False, verbose=True)
DEBUG: Instance details: {'uri': 'ldaps://ldap-model.polytechnique.fr:636', 'basedn': None, 'binddn': 'cn=Directory Manager', 'bindpw': None, 'saslmech': None, 'tls_cacertdir': None, 'tls_cert': None, 'tls_key': None, 'tls_reqcert': 1, 'starttls': False, 'prompt': False, 'pwdfile': None, 'args': {'ldapurl': 'ldaps://ldap-model.polytechnique.fr:636', 'root-dn': 'cn=Directory Manager'}}
DEBUG: SER_SERVERID_PROP not provided, assuming non-local instance
DEBUG: Allocate <class 'lib389.DirSrv'> with ldaps://ldap-model.polytechnique.fr:636
DEBUG: Allocate <class 'lib389.DirSrv'> with ldap-centos8.polytechnique.fr:389
DEBUG: Allocate <class 'lib389.DirSrv'> with ldap-centos8.polytechnique.fr:389
DEBUG: SER_SERVERID_PROP not provided, assuming non-local instance
DEBUG: Allocate <class 'lib389.DirSrv'> with ldaps://ldap-model.polytechnique.fr:636
DEBUG: Allocate <class 'lib389.DirSrv'> with ldap-centos8.polytechnique.fr:389
DEBUG: Allocate <class 'lib389.DirSrv'> with ldap-centos8.polytechnique.fr:389
DEBUG: open(): Connecting to uri ldaps://ldap-model.polytechnique.fr:636
DEBUG: open(): bound as cn=Directory Manager
DEBUG: cn=config getVal('nsslapd-security')
DEBUG: cn=config getVal('nsslapd-securelistenhost')
DEBUG: cn=config getVal('nsslapd-securePort')
DEBUG: cn=encryption,cn=config getVal('nsSSLClientAuth')
DEBUG: cn=encryption,cn=config getVal('nsTLSAllowClientRenegotiation')
DEBUG: cn=config getVal('nsslapd-require-secure-binds')
DEBUG: cn=config getVal('nsslapd-ssl-check-hostname')
DEBUG: cn=config getVal('nsslapd-validate-cert')
DEBUG: cn=encryption,cn=config getVal('nsSSLSessionTimeout')
DEBUG: cn=encryption,cn=config getVal('sslVersionMin')
DEBUG: cn=encryption,cn=config getVal('sslVersionMax')
DEBUG: cn=encryption,cn=config getVal('allowWeakCipher')
DEBUG: cn=encryption,cn=config getVal('allowWeakDHParam')
DEBUG: cn=encryption,cn=config getVal('nsSSL3Ciphers')
nsslapd-security: on
nsslapd-securelistenhost:
nsslapd-secureport: 636
[root@ldap-centos8 ~]# dsconf -v ldaps://ldap-model.polytechnique.fr:636 -D "cn=Directory Manager" -w mypass security get
DEBUG: The 389 Directory Server Configuration Tool
DEBUG: Inspired by works of: ITS, The University of Adelaide
DEBUG: dsrc path: /root/.dsrc
DEBUG: dsrc container path: /data/config/container.inf
DEBUG: dsrc instances: []
DEBUG: dsrc no such section: slapd-ldaps://ldap-model.polytechnique.fr:636
DEBUG: Called with: Namespace(basedn=None, binddn='cn=Directory Manager', bindpw='mypass', func=<function _security_generic_get_parser.<locals>.<lambda> at 0x7f8b96a197b8>, instance='ldaps://ldap-model.polytechnique.fr:636', json=False, prompt=False, pwdfile=None, starttls=False, verbose=True)
DEBUG: Instance details: {'uri': 'ldaps://ldap-model.polytechnique.fr:636', 'basedn': None, 'binddn': 'cn=Directory Manager', 'bindpw': None, 'saslmech': None, 'tls_cacertdir': None, 'tls_cert': None, 'tls_key': None, 'tls_reqcert': 1, 'starttls': False, 'prompt': False, 'pwdfile': None, 'args': {'ldapurl': 'ldaps://ldap-model.polytechnique.fr:636', 'root-dn': 'cn=Directory manager'}}
DEBUG: SER_SERVERID_PROP not provided, assuming non-local instance
DEBUG: Allocate <class 'lib389.DirSrv'> with ldaps://ldap-model.polytechnique.fr:636
DEBUG: Allocate <class 'lib389.DirSrv'> with ldap-centos8.polytechnique.fr:389
DEBUG: Allocate <class 'lib389.DirSrv'> with ldap-centos8.polytechnique.fr:389
DEBUG: SER_SERVERID_PROP not provided, assuming non-local instance
DEBUG: Allocate <class 'lib389.DirSrv'> with ldaps://ldap-model.polytechnique.fr:636
DEBUG: Allocate <class 'lib389.DirSrv'> with ldap-centos8.polytechnique.fr:389
DEBUG: Allocate <class 'lib389.DirSrv'> with ldap-centos8.polytechnique.fr:389
DEBUG: open(): Connecting to uri ldaps://ldap-model.polytechnique.fr:636
DEBUG: Using dirsrv ca certificate /etc/dirsrv/slapd-{instance_name}
DEBUG: Using external ca certificate /etc/dirsrv/slapd-{instance_name}
DEBUG: Using external ca certificate /etc/dirsrv/slapd-{instance_name}
DEBUG: Using certificate policy 1
DEBUG: ldap.OPT_X_TLS_REQUIRE_CERT = 1
DEBUG: Cannot connect to 'ldaps://ldap-model.polytechnique.fr:636'
DEBUG: {'desc': "Can't contact LDAP server", 'info': 'error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed (self signed certificate in certificate chain)'}
Traceback (most recent call last):
File "/usr/sbin/dsconf", line 133, in <module>
inst = connect_instance(dsrc_inst=dsrc_inst, verbose=args.verbose, args=args)
File "/usr/lib/python3.6/site-packages/lib389/cli_base/__init__.py", line 152, in connect_instance
starttls=dsrc_inst['starttls'], connOnly=True)
File "/usr/lib/python3.6/site-packages/lib389/__init__.py", line 1076, in open
raise e
File "/usr/lib/python3.6/site-packages/lib389/__init__.py", line 1072, in open
self.simple_bind_s(ensure_str(self.binddn), self.bindpw, escapehatch='i am sure')
File "/usr/lib/python3.6/site-packages/lib389/__init__.py", line 180, in inner
return f(*args, **kwargs)
File "/usr/lib64/python3.6/site-packages/ldap/ldapobject.py", line 443, in simple_bind_s
msgid = self.simple_bind(who,cred,serverctrls,clientctrls)
File "/usr/lib/python3.6/site-packages/lib389/__init__.py", line 180, in inner
return f(*args, **kwargs)
File "/usr/lib64/python3.6/site-packages/ldap/ldapobject.py", line 437, in simple_bind
return self._ldap_call(self._l.simple_bind,who,cred,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
File "/usr/lib/python3.6/site-packages/lib389/__init__.py", line 180, in inner
return f(*args, **kwargs)
File "/usr/lib64/python3.6/site-packages/ldap/ldapobject.py", line 329, in _ldap_call
reraise(exc_type, exc_value, exc_traceback)
File "/usr/lib64/python3.6/site-packages/ldap/compat.py", line 44, in reraise
raise exc_value
File "/usr/lib64/python3.6/site-packages/ldap/ldapobject.py", line 313, in _ldap_call
result = func(*args,**kwargs)
ldap.SERVER_DOWN: {'desc': "Can't contact LDAP server", 'info': 'error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed (self signed certificate in certificate chain)'}
ERROR: Error: Can't contact LDAP server - error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed (self signed certificate in certificate chain)
