6

I've used to use the following command to download my server SSL certs from LDAP in order to add them to tomcat/java keystores:

openssl s_client -connect 10.140.136.192:636

Since LDAP SSL (port 636) has been deprecated, I don't have port 636 available anymore. I've tried to find various incantations for openssl s_client such as -starttls and -tls1_2 however none of them produce the certificate. What is the magic word to do this?

Server Fault
  • 3,714
  • 12
  • 54
  • 89
  • Two upstream issues: https://github.com/openssl/openssl/issues/1733 and https://github.com/openssl/openssl/issues/1955 – akostadinov Feb 23 '17 at 11:16

1 Answers1

5

OpenSSL supports starttls for a number of protocols with s_client:

-starttls protocol
send the protocol-specific message(s) to switch to TLS for communication. protocol is a keyword for the intended protocol. Currently, the only supported keywords are "smtp", "pop3", "imap", and "ftp".

which would allow you to easily retrieve the public certificate but LDAP isn't one them, unfortunately.

Since the upgrade to TLS is protocol specific you need a tool that understands the protocol. That rules out OpenSSL.

I don't have a directory at hand but wouldn't the verbose ldapsearch -Z -v -H ldap://ldap.example.com:389 ... display the certificate as part of the debugging info?
A quick search shows that Apache Directory studio will display the certificate too.

Update:

Openssl 1.1.1 included a patch to add LDAP support (RFC 4511) to s_client and -starttls ldap is now supported. RHEL/CentOS 7 versions of openssl appear to have backported that update (and others) to the openssl 1.0.2k package they ship, as the manual now has 8 additional starttls protocols:

-starttls protocol
send the protocol-specific message(s) to switch to TLS for communication. protocol is a keyword for the intended protocol. Currently, the only supported keywords are smtp, pop3, imap, ftp, xmpp, xmpp-server, irc, postgres, lmtp, nntp, sieve and ldap.

HBruijn
  • 77,029
  • 24
  • 135
  • 201
  • 1
    No luck with that `ldapsearch` command. Strange. I don't see a clear way to retrieve an LDAP cert from a server (other than emailing/SSH) unless it is configured with deprecated LDAPS. *EDIT*: `ldapsearch -d 255 -x -Z -H ldap://my.ldap.server` does display the cert but it's a Hex dump. Not so great for cutting and pasting, but it's something. – Server Fault Jul 27 '15 at 19:43
  • Thanks for the update. Currently no backport for Ubuntu LTS, but good to know. – Server Fault Oct 29 '18 at 18:32