delorie.com/archives/browse.cgi   search  
Mail Archives: cygwin/2019/08/02/22:43:02

X-Recipient: archive-cygwin AT delorie DOT com
DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
:list-unsubscribe:list-subscribe:list-archive:list-post
:list-help:sender:mime-version:references:in-reply-to:from:date
:message-id:subject:to:content-type; q=dns; s=default; b=amWJgzR
vfP/BKJwvoIcQx22cuZQJz/Bp6tLtAW9Q6cX6ZgP7alRQiGuFhKskfytRvgF/DdK
vYAQv4NVnZyE7uWckwBmWyYczIa2iGJOtvfUVTO1uI6Kz++rPnlXd/DJk/shFuVL
CntSXl5hu34rv96Kcd/uvQxHqqydZNcsvUi8=
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id
:list-unsubscribe:list-subscribe:list-archive:list-post
:list-help:sender:mime-version:references:in-reply-to:from:date
:message-id:subject:to:content-type; s=default; bh=i3RM7qXTtMUj/
qTvmzec7ykTDB8=; b=KYs2nAjpVdce6nf/ORLbkWMTD+WR/K3sEc16wRywME4hb
I3Z7G4SBAoDpWH0kFRzR+iCkrGhL2yv/tLTel/To3qCRMZ4pLPggRgcdl635W7f9
MYQ5voJkAPNBSk5d4l5gzYsCsRkSGPteF5TfTL+JImgK5Z/+fLk0MA24pd543o=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id: <cygwin.cygwin.com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com
Authentication-Results: sourceware.org; auth=none
X-Spam-SWARE-Status: No, score=-1.8 required=5.0 tests=AWL,BAYES_00,FREEMAIL_ENVFROM_END_DIGIT,FREEMAIL_FROM,HTML_MESSAGE,RCVD_IN_DNSWL_NONE,SPF_PASS autolearn=no version=3.3.1 spammy=H*c:alternative, certified, services, phone
X-HELO: mail-qk1-f182.google.com
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=U3ctDs2bblo0ihNUbLwS2oSPWMlkN3T19iGSOCI3xQ8=; b=rnuN6+QH9rY8Q+BkFkvHmugDL9PR2GpEPTdyuHbRmvVxG30iz1JaQBFbj97RtnOk0b 9rdfymBc5ttagtCtagnwKNg0jZuxXsjOoIhIKtlajxAw44n/hXPNroQYjeptlTu62vED n8E9miNNCsQSQvT9MdbFmNRtyHw8qnKxj/SYTQY544UvcxH7IaQXe+N28KgTs3feqyd8 vRlRn9oVnXeYbwqGJeP5Sb0cX7k4b9wVFRlhnrthbPtD0IB4F/E5DmQF9ZGeWIJxZ7Sz rvwuWRMmCbbOzNgYJfXfnRIz5JlNh9yswZgVwi/KHRIAEcggu1tuuX8i83FGKZlrGbob NwNg==
MIME-Version: 1.0
References: <CAN9EdkY=zrEv31+PD8XXu9rVw4H_eXLEoMk5u=7H02Q1Xu7-Wg AT mail DOT gmail DOT com> <F9D491FCA6B56B38D0C0B1D6 AT 192 DOT 168 DOT 1 DOT 39>
In-Reply-To: <F9D491FCA6B56B38D0C0B1D6@192.168.1.39>
From: David Goldberg <dsg18096 AT gmail DOT com>
Date: Fri, 2 Aug 2019 22:41:56 -0400
Message-ID: <CAN9EdkboW3E=YcFe0sVS+_LW0bhFnaE5qEB_k-nhdL=SDB4fVg@mail.gmail.com>
Subject: Re: Openldap 2.4.48-1 vs my company's pki
To: cygwin AT cygwin DOT com
X-IsSubscribed: yes 

One downside of having to do non-work email on my phone while at work is
that I didn't realize my reply to Quanah was direct, not to the list.
Sorry about that.  Trying again:

I did the following to try to answer

$ ldd /usr/bin/ldapsearch.exe # 2.4.42

        ntdll.dll => /cygdrive/c/WINDOWS/SYSTEM32/ntdll.dll (0x7ffc58b50000)

        KERNEL32.DLL => /cygdrive/c/WINDOWS/System32/KERNEL32.DLL
(0x7ffc57bd0000)

        KERNELBASE.dll => /cygdrive/c/WINDOWS/System32/KERNELBASE.dll
(0x7ffc554b0000)

        SYSFER.DLL => /cygdrive/c/WINDOWS/System32/SYSFER.DLL (0x59e30000)

        ADVAPI32.dll => /cygdrive/c/WINDOWS/System32/ADVAPI32.dll
(0x7ffc57b20000)

        msvcrt.dll => /cygdrive/c/WINDOWS/System32/msvcrt.dll
(0x7ffc57950000)

        sechost.dll => /cygdrive/c/WINDOWS/System32/sechost.dll
(0x7ffc563a0000)

        RPCRT4.dll => /cygdrive/c/WINDOWS/System32/RPCRT4.dll
(0x7ffc581d0000)

        cygwin1.dll => /usr/bin/cygwin1.dll (0x180040000)

        cyglber-2-4-2.dll => /usr/bin/cyglber-2-4-2.dll (0x3fbd60000)

        cygsasl2-3.dll => /usr/bin/cygsasl2-3.dll (0x3faae0000)

        cygldap-2-4-2.dll => /usr/bin/cygldap-2-4-2.dll (0x3fb9b0000)

        cygcrypto-1.0.0.dll => /usr/bin/cygcrypto-1.0.0.dll (0x3fe480000)

        cygz.dll => /usr/bin/cygz.dll (0x3fa000000)

        cygssl-1.0.0.dll => /usr/bin/cygssl-1.0.0.dll (0x3fa860000)

And

$ ldd /usr/bin/ldapsearch.exe # 2.4.48

        ntdll.dll => /cygdrive/c/WINDOWS/SYSTEM32/ntdll.dll (0x7ffc58b50000)

        KERNEL32.DLL => /cygdrive/c/WINDOWS/System32/KERNEL32.DLL
(0x7ffc57bd0000)

        KERNELBASE.dll => /cygdrive/c/WINDOWS/System32/KERNELBASE.dll
(0x7ffc554b0000)

        SYSFER.DLL => /cygdrive/c/WINDOWS/System32/SYSFER.DLL (0x59e30000)

        ADVAPI32.dll => /cygdrive/c/WINDOWS/System32/ADVAPI32.dll
(0x7ffc57b20000)

        msvcrt.dll => /cygdrive/c/WINDOWS/System32/msvcrt.dll
(0x7ffc57950000)

        sechost.dll => /cygdrive/c/WINDOWS/System32/sechost.dll
(0x7ffc563a0000)

        RPCRT4.dll => /cygdrive/c/WINDOWS/System32/RPCRT4.dll
(0x7ffc581d0000)

        cygwin1.dll => /usr/bin/cygwin1.dll (0x180040000)

        cyglber-2-4-2.dll => /usr/bin/cyglber-2-4-2.dll (0x3fbd60000)

        cygsasl2-3.dll => /usr/bin/cygsasl2-3.dll (0x3faae0000)

        cygldap-2-4-2.dll => /usr/bin/cygldap-2-4-2.dll (0x3fb9b0000)

        cygssl-1.1.dll => /usr/bin/cygssl-1.1.dll (0x3fa7d0000)

        ??? => ??? (0xe80000)

        cygcrypto-1.1.dll => /usr/bin/cygcrypto-1.1.dll (0x3fe210000)

        cygz.dll => /usr/bin/cygz.dll (0x3fa000000)

So something seems weird with one showing cygssl 1.1 and maybe something
missing while the working one shows cygssl 1.0.  any idea how I might
resolve that?

Thanks
-- 
Dave Goldberg
dsg18096 AT gmail DOT com


On Fri, Aug 2, 2019 at 1:28 PM Quanah Gibson-Mount <quanah AT symas DOT com> wrote:

> --On Friday, August 02, 2019 12:45 PM -0400 David Goldberg
> <dsg18096 AT gmail DOT com> wrote:
>
> > I updated openldap from 2.4.42-1 to 2.4.48-1 this morning and now
> > ldapsearch will not connect, complaining that the server provided
> > certificate is self signed. I have set up /etc/pki with my company's
> > certificate chain and that allows 2.4.42-1 (and earlier) and other
> > applications to properly authenticate local services. What has changed in
> > 2.4.48-1 that causes this to not work and how can I fix it. I've
> > downgraded for now; that is not a good long term solution of course.
>
> What SSL library is being used for each of the two builds (I.e., gnutls?
> openssl? moznss?)  What SSL library version did 2.4.42 link to?  What SSL
> library version does 2.4.48 link to?  Generally OpenLDAP should be linked
> to OpenSSL which uses PEM formatted certificates.  Also check whether you
> have a global ldap.conf file (usually something like
> /etc/openldap/ldap.conf or /etc/ldap.conf, etc, depending on how OpenLDAP
> was built) that defines where to find the CA Cert(s), or a ~user/.ldaprc,
> etc.  OpenLDAP client utilities generally by default do not search for a
> global list of CA certificates.
>
> --Quanah
>
> --
>
> Quanah Gibson-Mount
> Product Architect
> Symas Corporation
> Packaged, certified, and supported LDAP solutions powered by OpenLDAP:
> <http://www.symas.com>
>
>

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

- Raw text -


  webmaster     delorie software   privacy  
  Copyright © 2019   by DJ Delorie     Updated Jul 2019