DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:mime-version:references:in-reply-to:from:date
	:message-id:subject:to:content-type; q=dns; s=default; b=amWJgzR
	vfP/BKJwvoIcQx22cuZQJz/Bp6tLtAW9Q6cX6ZgP7alRQiGuFhKskfytRvgF/DdK
	vYAQv4NVnZyE7uWckwBmWyYczIa2iGJOtvfUVTO1uI6Kz++rPnlXd/DJk/shFuVL
	CntSXl5hu34rv96Kcd/uvQxHqqydZNcsvUi8=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
MIME-Version: 1.0
References: <CAN9EdkY=zrEv31+PD8XXu9rVw4H_eXLEoMk5u=7H02Q1Xu7-Wg AT mail DOT gmail DOT com> <F9D491FCA6B56B38D0C0B1D6 AT 192 DOT 168 DOT 1 DOT 39>
In-Reply-To: <F9D491FCA6B56B38D0C0B1D6@192.168.1.39>
From: David Goldberg <dsg18096 AT gmail DOT com>
Date: Fri, 2 Aug 2019 22:41:56 -0400
Message-ID: <CAN9EdkboW3E=YcFe0sVS+_LW0bhFnaE5qEB_k-nhdL=SDB4fVg@mail.gmail.com>
Subject: Re: Openldap 2.4.48-1 vs my company's pki
To: cygwin AT cygwin DOT com
Content-Type: text/plain; charset="UTF-8"

One downside of having to do non-work email on my phone while at work is
that I didn't realize my reply to Quanah was direct, not to the list.
Sorry about that.  Trying again:

I did the following to try to answer

$ ldd /usr/bin/ldapsearch.exe # 2.4.42

        ntdll.dll => /cygdrive/c/WINDOWS/SYSTEM32/ntdll.dll (0x7ffc58b50000)

        KERNEL32.DLL => /cygdrive/c/WINDOWS/System32/KERNEL32.DLL
(0x7ffc57bd0000)

        KERNELBASE.dll => /cygdrive/c/WINDOWS/System32/KERNELBASE.dll
(0x7ffc554b0000)

        SYSFER.DLL => /cygdrive/c/WINDOWS/System32/SYSFER.DLL (0x59e30000)

        ADVAPI32.dll => /cygdrive/c/WINDOWS/System32/ADVAPI32.dll
(0x7ffc57b20000)

        msvcrt.dll => /cygdrive/c/WINDOWS/System32/msvcrt.dll
(0x7ffc57950000)

        sechost.dll => /cygdrive/c/WINDOWS/System32/sechost.dll
(0x7ffc563a0000)

        RPCRT4.dll => /cygdrive/c/WINDOWS/System32/RPCRT4.dll
(0x7ffc581d0000)

        cygwin1.dll => /usr/bin/cygwin1.dll (0x180040000)

        cyglber-2-4-2.dll => /usr/bin/cyglber-2-4-2.dll (0x3fbd60000)

        cygsasl2-3.dll => /usr/bin/cygsasl2-3.dll (0x3faae0000)

        cygldap-2-4-2.dll => /usr/bin/cygldap-2-4-2.dll (0x3fb9b0000)

        cygcrypto-1.0.0.dll => /usr/bin/cygcrypto-1.0.0.dll (0x3fe480000)

        cygz.dll => /usr/bin/cygz.dll (0x3fa000000)

        cygssl-1.0.0.dll => /usr/bin/cygssl-1.0.0.dll (0x3fa860000)

And

$ ldd /usr/bin/ldapsearch.exe # 2.4.48

        ntdll.dll => /cygdrive/c/WINDOWS/SYSTEM32/ntdll.dll (0x7ffc58b50000)

        KERNEL32.DLL => /cygdrive/c/WINDOWS/System32/KERNEL32.DLL
(0x7ffc57bd0000)

        KERNELBASE.dll => /cygdrive/c/WINDOWS/System32/KERNELBASE.dll
(0x7ffc554b0000)

        SYSFER.DLL => /cygdrive/c/WINDOWS/System32/SYSFER.DLL (0x59e30000)

        ADVAPI32.dll => /cygdrive/c/WINDOWS/System32/ADVAPI32.dll
(0x7ffc57b20000)

        msvcrt.dll => /cygdrive/c/WINDOWS/System32/msvcrt.dll
(0x7ffc57950000)

        sechost.dll => /cygdrive/c/WINDOWS/System32/sechost.dll
(0x7ffc563a0000)

        RPCRT4.dll => /cygdrive/c/WINDOWS/System32/RPCRT4.dll
(0x7ffc581d0000)

        cygwin1.dll => /usr/bin/cygwin1.dll (0x180040000)

        cyglber-2-4-2.dll => /usr/bin/cyglber-2-4-2.dll (0x3fbd60000)

        cygsasl2-3.dll => /usr/bin/cygsasl2-3.dll (0x3faae0000)

        cygldap-2-4-2.dll => /usr/bin/cygldap-2-4-2.dll (0x3fb9b0000)

        cygssl-1.1.dll => /usr/bin/cygssl-1.1.dll (0x3fa7d0000)

        ??? => ??? (0xe80000)

        cygcrypto-1.1.dll => /usr/bin/cygcrypto-1.1.dll (0x3fe210000)

        cygz.dll => /usr/bin/cygz.dll (0x3fa000000)

So something seems weird with one showing cygssl 1.1 and maybe something
missing while the working one shows cygssl 1.0.  any idea how I might
resolve that?

Thanks
-- 
Dave Goldberg
dsg18096 AT gmail DOT com


On Fri, Aug 2, 2019 at 1:28 PM Quanah Gibson-Mount <quanah AT symas DOT com> wrote:

> --On Friday, August 02, 2019 12:45 PM -0400 David Goldberg
> <dsg18096 AT gmail DOT com> wrote:
>
> > I updated openldap from 2.4.42-1 to 2.4.48-1 this morning and now
> > ldapsearch will not connect, complaining that the server provided
> > certificate is self signed. I have set up /etc/pki with my company's
> > certificate chain and that allows 2.4.42-1 (and earlier) and other
> > applications to properly authenticate local services. What has changed in
> > 2.4.48-1 that causes this to not work and how can I fix it. I've
> > downgraded for now; that is not a good long term solution of course.
>
> What SSL library is being used for each of the two builds (I.e., gnutls?
> openssl? moznss?)  What SSL library version did 2.4.42 link to?  What SSL
> library version does 2.4.48 link to?  Generally OpenLDAP should be linked
> to OpenSSL which uses PEM formatted certificates.  Also check whether you
> have a global ldap.conf file (usually something like
> /etc/openldap/ldap.conf or /etc/ldap.conf, etc, depending on how OpenLDAP
> was built) that defines where to find the CA Cert(s), or a ~user/.ldaprc,
> etc.  OpenLDAP client utilities generally by default do not search for a
> global list of CA certificates.
>
> --Quanah
>
> --
>
> Quanah Gibson-Mount
> Product Architect
> Symas Corporation
> Packaged, certified, and supported LDAP solutions powered by OpenLDAP:
> <http://www.symas.com>
>
>

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple