Enabling Secure LDAP (SSL/TLS) and certificate verification in OpenLDAP

1. Obtain a certificate, using the server name for the Common Name (CN). This should correspond to the server name your LDAP clients will be using.

   Upon completion you will have a private-key file (host.key) and public-key (certificate) file (host.cert). Rename the files as needed, or adjust the values in the next step.

2. Edit your slapd.conf, adding these lines

   TLSCipherSuite  HIGH:MEDIUM
   TLSCertificateFile      /etc/openldap/certs/host.cert
   TLSCertificateKeyFile   /etc/openldap/certs/host.key
   

3. Create your /etc/openldap/certs folder and put the files there.

   mkdir /etc/openldap/certs
   cp host.key host.cert /etc/openldap/certs/
   

4. You may also want to use a CA certificate for verifying your clients. You may download the Credentia CA certificate from here. Other CA certificates (VeriSign, Thawte, Geotrust etc) can simply be exported from Internet Explorer (Windows) or Netscape/Mozilla (Unix/Linux).

   cp credentia1.cacert /etc/openldap/certs/cacert.pem
   

   Edit your slapd.conf file, adding this line

   TLSCACertificateFile /etc/openldap/certs/cacert.pem
   TLSVerifyClient allow
   

5. Now restart OpenLDAP and you're done.
   NOTE: You will need to specify something like -H ldaps://12.34.56.78/ in your slapd startup options. This is done differently depending on your operating system. See the Paranoid Penguin article for more details.

See Also