Djerk Geurts via FreeIPA-users wrote:
This is locally on the FreeIPA server, so I would expect the
certificate to be trusted. Why would one work and not the other?!
user@ipa:~$ ldapsearch -x -H LDAPS://ipa.domain.com:636 -D 'cn=Directory Manager'
-W "(objectClass=*)" -b cn=config -s base nsslapd-allow-anonymous-access
Enter LDAP Password:
# extended LDIF
#
# LDAPv3
[...]
# numResponses: 2
# numEntries: 1
user@ipa:~$ ldapmodify -x -D 'cn=Directory Manager' -W -H
LDAPS://ipa.domain.com:636
Enter LDAP Password:
ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)
I'd add -d255 to your command-line to get debug output on what is going
on. -1 is usually a generic "cannot connect" error message. I find it
unlikely to be related to certificates.
255 is a fire hose of info so you may want/need to reduce it, but since
its a connection failure it should be relatively short.
rob