LDAP connection problem with self-signed cert

Question

The code I am using:

# Create LDAPObject instance
conn = ldap.initialize(url)
conn.protocol_version=ldap.VERSION3

conn.simple_bind_s(binddn,bindpw)
# This raises:
# ldap.SERVER_DOWN: 
    {'info': 'error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed', 'desc': "Can't contact LDAP server"}

When I use ldap:// instead of ldaps://, it works correctly.

Can anybody help me figure out why this is?

Thanks. :)

score 30 · Answer 1 · answered Jan 09 '12 at 21:52

30

I came here looking for a solution to my problem related to this. This Q&A did not solve my exact problem, but others looking for my exact problem's solution will find the following useful:

For those using SSL/TLS for basic transport encryption and not identity verification (self-signed certificates), you just turn off strict checking of the server certificate:

ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_ALLOW)

This is roughly analogous to setting the OpenLDAP 2.1+ client setting:

tls_checkpeer no

answered Jan 09 '12 at 21:52

jblaine

520
5
8

1

This does not turn strict checking off. Instead of `ldap.OPT_X_TLS_ALLOW` it should read `ldap.OPT_X_TLS_NEVER`. – Olli Feb 24 '14 at 13:37
2

It does turn off *strict* checking, just not in the extreme sense of that wording. OPT_X_TLS_NEVER doesn't even try to verify the certificate. OPT_X_TLS_ALLOW tries to verify the certificate but failure to verify the certificate is ignored. We'll probably have to agree to disagree ;) – jblaine Oct 12 '16 at 21:00
I had already set the ```LDAPTLS_REQCERT=never``` with no luck. This totally worked for me. Thanks. – drkostas Aug 08 '19 at 09:58
This does seem like the cleaner solution. Both `NEVER` and `ALLOW` appear to work, but `NEVER` seems more relaxed than `ALLOW`. – Peter Ilfrich Sep 29 '20 at 13:40

score 13 · Answer 2 · answered Feb 07 '14 at 14:37

13

to ignore certificate errors

ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_NEVER)

answered Feb 07 '14 at 14:37

navendu

264
2
2

5

Only just figured out that this needs to be BEFORE the initialise. – Danny Staple Oct 25 '19 at 12:19

score 7 · Accepted Answer · edited Oct 25 '18 at 11:57

7

I've never used python-ldap over SSL but I believe you have to tell ldap what checks to perform on the server certificate. If this is set to demand (which might be the default), you have to give it valid certs.

See the initialize.py in the Demo directory the source.

edited Oct 25 '18 at 11:57

Antwane

20,760
7
51
84

answered Aug 16 '10 at 19:01

Mark

106,305
20
172
230

initialize.py was perfect. Thanks! :) – Aug 17 '10 at 14:55

score 2 · Answer 4 · edited May 23 '17 at 12:03

2

Try to pass the following environment variable:

LDAPTLS_REQCERT=never

to ignore server certificate which could be expired or invalid.

See:

edited May 23 '17 at 12:03

Community

1
1

answered Jan 17 '14 at 16:32

kenorb

155,785
88
678
743

Rafael Gramoschi · Answer 5 · 2023-01-26T09:11:25.730

PAY much attention to your protocol and port in your connection string:

Using TLS with python-ldap:

# TLS uses string uri 'ldaP://' (NO 's')
# then the method start_tls_s() will transfer to a secure connection
l = ldap.initialize('ldap://localhost:1390',trace_level=ldapmodule_trace_level,trace_file=ldapmodule_trace_file)

# Set LDAP protocol version used
l.protocol_version=ldap.VERSION3

# Force cert validation
l.set_option(ldap.OPT_X_TLS_REQUIRE_CERT,ldap.OPT_X_TLS_DEMAND)
# Set path name of file containing all trusted CA certificates
l.set_option(ldap.OPT_X_TLS_CACERTFILE,CACERTFILE)
# Force libldap to create a new SSL context (must be last TLS option!)
l.set_option(ldap.OPT_X_TLS_NEWCTX,0)

# Now try StartTLS extended operation
l.start_tls_s()

print('***ldap.OPT_X_TLS_VERSION',l.get_option(ldap.OPT_X_TLS_VERSION))
print('***ldap.OPT_X_TLS_CIPHER',l.get_option(ldap.OPT_X_TLS_CIPHER))

# Try an explicit anon bind to provoke failure
l.simple_bind_s('','')

# Close connection
l.unbind_s()

SSL uses 'ldapS://' directly!

And it doesn't use the start_tls_s()

# Create LDAPObject instance
l = ldap.initialize('ldaps://localhost:1391',trace_level=ldapmodule_trace_level,trace_file=ldapmodule_trace_file)

# Set LDAP protocol version used
l.protocol_version=ldap.VERSION3

# Force cert validation
l.set_option(ldap.OPT_X_TLS_REQUIRE_CERT,ldap.OPT_X_TLS_DEMAND)
# Set path name of file containing all trusted CA certificates
l.set_option(ldap.OPT_X_TLS_CACERTFILE,CACERTFILE)
# Force libldap to create a new SSL context (must be last TLS option!)
l.set_option(ldap.OPT_X_TLS_NEWCTX,0)

# Try an explicit anon bind to provoke failure
l.simple_bind_s('','')

print('***ldap.OPT_X_TLS_VERSION',l.get_option(ldap.OPT_X_TLS_VERSION))
print('***ldap.OPT_X_TLS_CIPHER',l.get_option(ldap.OPT_X_TLS_CIPHER))

# Close connection
l.unbind_s()

source: original developers github demo initialize.py

LDAP connection problem with self-signed cert

5 Answers5