Can someone explain tls/ssl ldap stuff for me?

[Scarpozzi]

I'm having problems.

I'm trying to connect to a cluster of ldap servers being load balanced that have a single wildcard cert being delivered on port 636.

I have numerous (not just a few....like 20+) clients that connect to this all day long without a problem.

One particular client, however, from the most major linux desktop distro these days is failing out of the box. Stupid Tahr. Anyhoo...

ldapsearch with -d1 flag says that a TLS packet has an unexpected length.

openssl says, all is well with the cert, chain, but that “No client certificate CA names sent”.

I'm not sure what the rub is here. I installed a vm just to test connections and get it working. Does anyone have any advice on where I should look or what I should try? This works out of the box with Cent7....doesn't with Trusty Tahr.

 

[Scarpozzi]

I'm having problems.

I'm trying to connect to a cluster of ldap servers being load balanced that have a single wildcard cert being delivered on port 636.

I have numerous (not just a few....like 20+) clients that connect to this all day long without a problem.

One particular client, however, from the most major linux desktop distro these days is failing out of the box. Stupid Tahr. Anyhoo...

ldapsearch with -d1 flag says that a TLS packet has an unexpected length.

openssl says, all is well with the cert, chain, but that “No client certificate CA names sent”.

I'm not sure what the rub is here. I installed a vm just to test connections and get it working. Does anyone have any advice on where I should look or what I should try? This works out of the box with Cent7....doesn't with Trusty Tahr.

I've gotten further along and found that the problem appears to be isolated to a particular version of gnuTLS not playing well with the certs. I'm hoping I can get another LDAP cert to test with to see if it is just a cert to gnuTLS incompatibility issue.