On March 20, 2017 at 5:28 PM info@gwarband.de wrote:
Can sombody say something about this request?
This is an email from the openldap-technical mailinglist from openldap.
Systemdetails are mention in the other email.
-------- Originalnachricht -------- Betreff: Re: Dovecot can't connect to openldap over starttls Datum: 2017-03-20 16:18 Absender: Dan White dwhite@cafedemocracy.org Empfänger: info@gwarband.de Kopie: openldap-technical@openldap.org
On 03/20/17 16:06 +0100, info@gwarband.de wrote:
Debug Dovecot's implementation of ldap_start_tls_s(). I don't have any idea how to set a higher debug level to dovecot. In my opinion I have the highest. So I can't deliver a greater log.
I recommend consulting Dovecot's advice on how to run a debugger, or dig into the code which calls libldap.
Hi! I just ran a quick test, and following things are needed:
uris = ldap://ldap.host.com tls = yes tls_ca_cert_file = /path/to/cert-bundle.crt
this has been tested with 2.2.28, and works just fine. Not sure why you are having issues.
Of course this could be anything between not finding compatible ciphers to the LDAP server actually expecting client certificate, what with the logs not actually being too verbose unfortunately. There isn't too much to "debug" in Dovecot's TLS implementation, it's not doing anything fancy asides from calling the ldap_start_tls_s.
I am not sure what debugging you could try further.
Aki