LDAP connection issues with TLS (1.3)
documentation
Hello
We had some issue with the LDAP connection for the password change.
After some reverse-engineering we could figure out, that PHP, resp. the `ldap_bind()` function didn't accept the SSL certificate:
```
TLS: peer cert untrusted or revoked (0x42)
```
This is due to the missing hint / link to the certificate authorities.
The `ca-certificates` (apt) package is installed, but the LDAP config is missing.
We could fix it by adding the following config:
```
cat /etc/ldap/ldap.conf
TLS_CACERT /etc/ssl/certs/ca-certificates.crt
```
This will define the CA certificate store to the one provided by the `ca-certificates` Debian package.
Alternatively `libldap-common` can be installed, as it will provide the default `/etc/ldap/ldap.conf` as well.
5 条评论