[CentOS] can't use godaddy SSL cert

Sun Nov 28 18:04:29 UTC 2010
bluethundr <bluethundr at gmail.com>

Hello CentOS:


 Thanks for your input..

> As mentioned in my previous mail, there is no need to specify >TLSCACertificateFile in slapd.conf unless your server will request client >certificate for authentication. Nor is there any point in trying multiple >files, you can concatenate the CA certificates into a single file.

I have removed TLSCACertificateFile form slapd and now recognize that
this directive is only needed on the client side. Thanks for clueing
me into that.

And here is my /etc/ldap.conf file on on the CentOS 5.5 client:

[root at VIRCENT03:~]#cat /etc/ldap.conf
host 192.168.1.44
base dc=summitnjhome,dc=com
sudoers_base ou=sudoers,ou=Services,dc=summitnjhome,dc=com
scope sub
pam_password exop
nss_base_passwd ou=staff,dc=summitnjhome,dc=com
nss_base_shadow ou=staff,dc=summitnjhome,dc=com
TLS_CACERT /etc/openldap/cacerts/gd_sf_all.crt


And here are the contents of the cacerts directory on the CentOS 55 client:

[root at VIRCENT03:~]#ls -l /etc/openldap/cacerts/
total 36
-r--r--r-- 1 root root 27529 Nov 28 12:10 all.crt
lrwxrwxrwx 1 root root     7 Nov 28 12:20 b737b221.0 -> all.crt


And this is the way that nsswitch is setup on the CentOS client:

passwd:     files ldap
shadow:     files ldap
group:      files ldap
sudoers:    ldap

  I have revised the location of the cert files on the server noted in
slapd.conf in order to separate out the certs from the cacerts. This
is just to organize things a little more neatly.

## TLS options for slapd
TLSCipherSuite HIGH:MEDIUM:+SSLv2
TLSCertificateFile  /usr/local/etc/openldap/certs/slapd.crt
TLSCertificateKeyFile /usr/local/etc/openldap/certs/slapd.pem

And here are the contents of the  /usr/local/etc/openldap/certs
directory, also on the server that is referenced in the TLS lines in
slapd.conf:

-r--r--r--  1 root  ldap  2309 Nov 26 18:52 LBSD2.summitnjhome.com.crt
dr--r--r--  3 root  ldap   512 Nov 28 03:32 bak
drwxr-xr-x  2 root  ldap   512 Nov 28 03:26 cacerts
-r--r--r--  1 root  ldap  2309 Nov 26 18:53 slapd.crt
-r--r--r--  1 root  ldap  1781 Nov 26 18:36 slapd.csr
-r--r--r--  1 root  ldap  3311 Nov 26 18:35 slapd.key
-r--r--r--  1 root  ldap  3243 Nov 26 18:54 slapd.pem


Here is the location of the cacert file on the server that the
/etc/ldap.conf file on the client references;

LBSD2# ls -l /usr/local/etc/openldap/certs/cacerts

-r--r--r--  1 root  ldap  27529 Nov 28 15:49 all.crt

The all.crt file is the result of concatenating these files together:

all.crt                    gdroot-g2.crt              sf_issuing.crt
ca_bundle.crt        sf_bundle.crt              sfroot-g2.crt
gd_bundle.crt        sf-class2-root.crt         sfsroot.crt
gd-class2-root.crt   sf_cross_intermediate.crt  sfsroot-g2.crt
gd_intermediate.crt  sf_intermediate.crt

Here is where the testing begins:

[root at VIRCENT03:~]#openssl s_client -connect ldap.summitnjhome.com:389
-showcerts -CAfile /usr/local/etc/openldap/certs/cacerts/all.crt
10073:error:02001002:system library:fopen:No such file or
directory:bss_file.c:122:fopen('/usr/local/etc/openldap/certs/cacerts/all.crt','r')
10073:error:2006D080:BIO routines:BIO_new_file:no such file:bss_file.c:125:
10073:error:0B084002:x509 certificate
routines:X509_load_cert_crl_file:system lib:by_file.c:279:
CONNECTED(00000003)
10073:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake
failure:s23_lib.c:188:

CONNECTED(00000003)
10065:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake
failure:s23_lib.c:188:

As you can see I have provided openssl the full path to the all.crt
file on the server and am still receiving a handshake failure. It
looks like openssl s_client is claiming that the all.crt file isn't
there when clearly it is!

> No. I assume that your hostname is the CN indicated above, so your -h is >not the issue. When you do -ZZ then ldapsearch will fail if it cannot  >validate the certificate. You can try with a single -Z to see if it works.

Yes the hostname is in the CN of the cert file. So I agree that -h is
not the issue. :)

 If I do an ldapsearch from the CentOS client it claims that it can't
verify the certificate:

[root at VIRCENT03:~]#ldapsearch -h ldap -b "dc=summitnjhome,dc=com" -Z
-D "cn=Manager,dc=summitnjhome,dc=com" "(objectclass=sudoRole)" -W
ldap_start_tls: Connect error (-11)
	additional info: error:14090086:SSL
routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
Enter LDAP Password:
ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1)
	additional info: error:14090086:SSL
routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

If I provide some more information with the -d -44 flags this is what I see:

[root at VIRCENT03:~]#ldapsearch -h ldap -b "dc=summitnjhome,dc=com" -d
-44 -Z -D "cn=Manager,dc=summitnjhome,dc=com" "(objectclass=sudoRole)"
-W
ber_dump: buf=0x8eb62e8 ptr=0x8eb62e8 end=0x8eb6307 len=31
  0000:  30 1d 02 01 01 77 18 80  16 31 2e 33 2e 36 2e 31   0....w...1.3.6.1
  0010:  2e 34 2e 31 2e 31 34 36  36 2e 32 30 30 33 37      .4.1.1466.20037
ber_dump: buf=0x8eb62e8 ptr=0x8eb62ed end=0x8eb6307 len=26
  0000:  77 18 80 16 31 2e 33 2e  36 2e 31 2e 34 2e 31 2e   w...1.3.6.1.4.1.
  0010:  31 34 36 36 2e 32 30 30  33 37                     1466.20037
ber_dump: buf=0x8eb7678 ptr=0x8eb7678 end=0x8eb7684 len=12
  0000:  02 01 01 78 07 0a 01 00  04 00 04 00               ...x........
ber_dump: buf=0x8eb7678 ptr=0x8eb767b end=0x8eb7684 len=9
  0000:  78 07 0a 01 00 04 00 04  00                        x........
request done: ld 0x8ead530 msgid 1
ber_dump: buf=0x8eb7678 ptr=0x8eb767b end=0x8eb7684 len=9
  0000:  78 07 0a 01 00 04 00 04  00                        x........
ber_dump: buf=0x8eb7678 ptr=0x8eb767b end=0x8eb7684 len=9
  0000:  78 07 0a 01 00 04 00 04  00                        x........
ber_dump: buf=0x8eb7678 ptr=0x8eb7684 end=0x8eb7684 len=0

TLS certificate verification: Error, unable to get local issuer certificate
TLS: can't connect.
ldap_start_tls: Connect error (-11)
	additional info: error:14090086:SSL
routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
Enter LDAP Password:
ldap_build_search_req ATTRS:
    supportedSASLMechanisms
ber_dump: buf=0x8f1e6a0 ptr=0x8f1e6a0 end=0x8f1e6e0 len=64
  0000:  30 3e 02 01 02 63 39 04  00 0a 01 00 0a 01 00 02   0>...c9.........
  0010:  01 00 02 01 00 01 01 00  87 0b 6f 62 6a 65 63 74   ..........object
  0020:  63 6c 61 73 73 30 19 04  17 73 75 70 70 6f 72 74   class0...support
  0030:  65 64 53 41 53 4c 4d 65  63 68 61 6e 69 73 6d 73   edSASLMechanisms
ber_dump: buf=0x8f1e6a0 ptr=0x8f1e6a5 end=0x8f1e6e0 len=59
  0000:  63 39 04 00 0a 01 00 0a  01 00 02 01 00 02 01 00   c9..............
  0010:  01 01 00 87 0b 6f 62 6a  65 63 74 63 6c 61 73 73   .....objectclass
  0020:  30 19 04 17 73 75 70 70  6f 72 74 65 64 53 41 53   0...supportedSAS
  0030:  4c 4d 65 63 68 61 6e 69  73 6d 73                  LMechanisms
ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1)
	additional info: error:14090086:SSL
routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed


I am including the output of a -d -1 as an attachment for those that
are still curious because the output of that command is quite long. :)

When I issue getent commands for passwd and group it hangs forever
when it tries to access information from ldap:

[root at VIRCENT03:~]#getent passwd | grep ldapAccount

[root at VIRCENT03:~]#getent group | grep ldapAccount

However if I remove TLS from the equation with the -x flag everything
starts working again:

[root at VIRCENT03:~]#ldapsearch -x -h ldap -b "dc=summitnjhome,dc=com"
-D "cn=Manager,dc=summitnjhome,dc=com" -w localG30rg3T0wn
"(objectclass=sudoRole)"
# extended LDIF
#
# LDAPv3
# base <dc=summitnjhome,dc=com> with scope subtree
# filter: (objectclass=sudoRole)
# requesting: ALL
#

# defaults, sudoers, Services, summitnjhome.com
dn: cn=defaults,ou=sudoers,ou=Services,dc=summitnjhome,dc=com
objectClass: top
objectClass: sudoRole
cn: defaults
description: Default sudoOption's go here

# %wheel, sudoers, Services, summitnjhome.com
dn: cn=%wheel,ou=sudoers,ou=Services,dc=summitnjhome,dc=com
objectClass: top
objectClass: sudoRole
cn: %wheel
sudoHost: ALL
sudoRunAsUser: ALL
sudoCommand: ALL
sudoOption: !authenticate
sudoUser: %wheel
sudoUser: bluethundr

# search result
search: 2
result: 0 Success

# numResponses: 3
# numEntries: 2



That's all I have for now. Sincere thanks to all those who have
provided input. I'll keep pounding away at this and hopefully figure
this out today.

Best regards!!!

On Thu, Nov 25, 2010 at 1:25 PM,  <cpolish at surewest.net> wrote:
> bluethundr wrote:
>> I have setup the certificate chain in my slapd.conf like so:
>>
>> TLSCACertificateFile  /usr/local/etc/openldap/cacerts/sf_issuing.crt
>
> I don't see where you say which directory these are stored in:
>
>> -rw-r--r--  1 root  bluethundr  2604 Nov 25 11:37 ca_bundle.crt
>> -r--r-----  1 root  ldap        4604 Nov 24 18:57 gd_bundle.crt
>> -r--r-----  1 root  ldap        1537 Nov 25 02:00 sf_issuing.crt
>
>> [root at LCENT01:/tmp/Foswiki-1.1.2]#openssl s_client -connect
>> ldap.example.com:389 -showcerts -CAfile sf_issuing.crt
>> 13730:error:02001002:system library:fopen:No such file or
>> directory:bss_file.c:122:fopen('sf_issuing.crt','r')
>
> It looks like the expected directory is not the one being
> used. Perhaps try use this invocation:
>
> openssl s_client -connect ldap.example.com:389 -showcerts -CAfile /path/to/sf_issuing.crt
>
> Best regards,
> --
> Charles Polisher
>
> _______________________________________________
> CentOS mailing list
> CentOS at centos.org
> http://lists.centos.org/mailman/listinfo/centos
>



-- 
Here's my RSA Public key:
gpg --keyserver pgp.mit.edu --recv-keys B6D6EAC3
-------------- next part --------------
[root at VIRCENT03:~]#ldapsearch -h ldap -b "dc=summitnjhome,dc=com" -d -1 -Z -D "cn=Manager,dc=summitnjhome,dc=com" "(objectclass=sudoRole)" -W
ldap_create
ldap_url_parse_ext(ldap://ldap)
ldap_extended_operation_s
ldap_extended_operation
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP ldap:389
ldap_new_socket: 3
ldap_prepare_socket: 3
ldap_connect_to_host: Trying 192.168.1.44:389
ldap_connect_timeout: fd: 3 tm: -1 async: 0
ldap_open_defconn: successful
ldap_send_server_request
ber_scanf fmt ({it) ber:
ber_dump: buf=0xa0312e8 ptr=0xa0312e8 end=0xa031307 len=31
  0000:  30 1d 02 01 01 77 18 80  16 31 2e 33 2e 36 2e 31   0....w...1.3.6.1  
  0010:  2e 34 2e 31 2e 31 34 36  36 2e 32 30 30 33 37      .4.1.1466.20037   
ber_scanf fmt ({) ber:
ber_dump: buf=0xa0312e8 ptr=0xa0312ed end=0xa031307 len=26
  0000:  77 18 80 16 31 2e 33 2e  36 2e 31 2e 34 2e 31 2e   w...1.3.6.1.4.1.  
  0010:  31 34 36 36 2e 32 30 30  33 37                     1466.20037        
ber_flush: 31 bytes to sd 3
  0000:  30 1d 02 01 01 77 18 80  16 31 2e 33 2e 36 2e 31   0....w...1.3.6.1  
  0010:  2e 34 2e 31 2e 31 34 36  36 2e 32 30 30 33 37      .4.1.1466.20037   
ldap_write: want=31, written=31
  0000:  30 1d 02 01 01 77 18 80  16 31 2e 33 2e 36 2e 31   0....w...1.3.6.1  
  0010:  2e 34 2e 31 2e 31 34 36  36 2e 32 30 30 33 37      .4.1.1466.20037   
ldap_result ld 0xa028530 msgid 1
wait4msg ld 0xa028530 msgid 1 (infinite timeout)
wait4msg continue ld 0xa028530 msgid 1 all 1
** ld 0xa028530 Connections:
* host: ldap  port: 389  (default)
  refcnt: 2  status: Connected
  last used: Sun Nov 28 12:39:55 2010

** ld 0xa028530 Outstanding Requests:
 * msgid 1,  origid 1, status InProgress
   outstanding referrals 0, parent count 0
** ld 0xa028530 Response Queue:
   Empty
ldap_chkResponseList ld 0xa028530 msgid 1 all 1
ldap_chkResponseList returns ld 0xa028530 NULL
ldap_int_select
read1msg: ld 0xa028530 msgid 1 all 1
ber_get_next
ldap_read: want=8, got=8
  0000:  30 0c 02 01 01 78 07 0a                            0....x..          
ldap_read: want=6, got=6
  0000:  01 00 04 00 04 00                                  ......            
ber_get_next: tag 0x30 len 12 contents:
ber_dump: buf=0xa032690 ptr=0xa032690 end=0xa03269c len=12
  0000:  02 01 01 78 07 0a 01 00  04 00 04 00               ...x........      
read1msg: ld 0xa028530 msgid 1 message type extended-result
ber_scanf fmt ({eaa) ber:
ber_dump: buf=0xa032690 ptr=0xa032693 end=0xa03269c len=9
  0000:  78 07 0a 01 00 04 00 04  00                        x........         
read1msg: ld 0xa028530 0 new referrals
read1msg:  mark request completed, ld 0xa028530 msgid 1
request done: ld 0xa028530 msgid 1
res_errno: 0, res_error: <>, res_matched: <>
ldap_free_request (origid 1, msgid 1)
ldap_parse_extended_result
ber_scanf fmt ({eaa) ber:
ber_dump: buf=0xa032690 ptr=0xa032693 end=0xa03269c len=9
  0000:  78 07 0a 01 00 04 00 04  00                        x........         
ldap_parse_result
ber_scanf fmt ({iaa) ber:
ber_dump: buf=0xa032690 ptr=0xa032693 end=0xa03269c len=9
  0000:  78 07 0a 01 00 04 00 04  00                        x........         
ber_scanf fmt (}) ber:
ber_dump: buf=0xa032690 ptr=0xa03269c end=0xa03269c len=0

ldap_msgfree
TLS trace: SSL_connect:before/connect initialization
tls_write: want=121, written=121
  0000:  80 77 01 03 01 00 4e 00  00 00 20 00 00 39 00 00   .w....N... ..9..  
  0010:  38 00 00 35 00 00 16 00  00 13 00 00 0a 07 00 c0   8..5............  
  0020:  00 00 33 00 00 32 00 00  2f 03 00 80 00 00 05 00   ..3..2../.......  
  0030:  00 04 01 00 80 00 00 15  00 00 12 00 00 09 06 00   ................  
  0040:  40 00 00 14 00 00 11 00  00 08 00 00 06 04 00 80   @...............  
  0050:  00 00 03 02 00 80 00 00  ff d2 49 1a b8 a2 59 29   ..........I...Y)  
  0060:  8f 56 dd af 9e fb 9b f7  1a cd 7f fd f4 12 ed c2   .V..............  
  0070:  c8 7c 9b 74 fb bf 22 10  3e                        .|.t..".>         
TLS trace: SSL_connect:SSLv2/v3 write client hello A
tls_read: want=7, got=7
  0000:  16 03 01 00 4a 02 00                               ....J..           
tls_read: want=72, got=72
  0000:  00 46 03 01 4c f2 cd 04  36 77 bc 36 fd a3 c6 bd   .F..L...6w.6....  
  0010:  9d d4 2f 03 6a 9d e7 5a  92 fe 58 1a ab 98 7b 3a   ../.j..Z..X...{:  
  0020:  d1 09 8f 82 20 c4 84 9a  2b 22 6f 9b f7 92 4e 18   .... ...+"o...N.  
  0030:  96 86 0e 4a 0a 5d 14 0d  a9 f7 17 db 94 21 4c 3f   ...J.].......!L?  
  0040:  cd e0 6f 41 f6 00 35 00                            ..oA..5.          
TLS trace: SSL_connect:SSLv3 read server hello A
tls_read: want=5, got=5
  0000:  16 03 01 06 8b                                     .....             
tls_read: want=1675, got=1364
  0000:  0b 00 06 87 00 06 84 00  06 81 30 82 06 7d 30 82   ..........0..}0.  
  0010:  05 65 a0 03 02 01 02 02  07 04 30 d7 a0 27 65 40   .e........0..'e@  
  0020:  30 0d 06 09 2a 86 48 86  f7 0d 01 01 05 05 00 30   0...*.H........0  
  0030:  81 ca 31 0b 30 09 06 03  55 04 06 13 02 55 53 31   ..1.0...U....US1  
  0040:  10 30 0e 06 03 55 04 08  13 07 41 72 69 7a 6f 6e   .0...U....Arizon  
  0050:  61 31 13 30 11 06 03 55  04 07 13 0a 53 63 6f 74   a1.0...U....Scot  
  0060:  74 73 64 61 6c 65 31 1a  30 18 06 03 55 04 0a 13   tsdale1.0...U...  
  0070:  11 47 6f 44 61 64 64 79  2e 63 6f 6d 2c 20 49 6e   .GoDaddy.com, In  
  0080:  63 2e 31 33 30 31 06 03  55 04 0b 13 2a 68 74 74   c.1301..U...*htt  
  0090:  70 3a 2f 2f 63 65 72 74  69 66 69 63 61 74 65 73   p://certificates  
  00a0:  2e 67 6f 64 61 64 64 79  2e 63 6f 6d 2f 72 65 70   .godaddy.com/rep  
  00b0:  6f 73 69 74 6f 72 79 31  30 30 2e 06 03 55 04 03   ository100...U..  
  00c0:  13 27 47 6f 20 44 61 64  64 79 20 53 65 63 75 72   .'Go Daddy Secur  
  00d0:  65 20 43 65 72 74 69 66  69 63 61 74 69 6f 6e 20   e Certification   
  00e0:  41 75 74 68 6f 72 69 74  79 31 11 30 0f 06 03 55   Authority1.0...U  
  00f0:  04 05 13 08 30 37 39 36  39 32 38 37 30 1e 17 0d   ....079692870...  
  0100:  31 30 31 31 32 36 31 39  33 35 31 37 5a 17 0d 31   101126193517Z..1  
  0110:  31 31 31 32 35 30 31 30  31 34 31 5a 30 65 31 1f   11125010141Z0e1.  
  0120:  30 1d 06 03 55 04 0a 13  16 4c 42 53 44 32 2e 73   0...U....LBSD2.s  
  0130:  75 6d 6d 69 74 6e 6a 68  6f 6d 65 2e 63 6f 6d 31   ummitnjhome.com1  
  0140:  21 30 1f 06 03 55 04 0b  13 18 44 6f 6d 61 69 6e   !0...U....Domain  
  0150:  20 43 6f 6e 74 72 6f 6c  20 56 61 6c 69 64 61 74    Control Validat  
  0160:  65 64 31 1f 30 1d 06 03  55 04 03 13 16 4c 42 53   ed1.0...U....LBS  
  0170:  44 32 2e 73 75 6d 6d 69  74 6e 6a 68 6f 6d 65 2e   D2.summitnjhome.  
  0180:  63 6f 6d 30 82 02 22 30  0d 06 09 2a 86 48 86 f7   com0.."0...*.H..  
  0190:  0d 01 01 01 05 00 03 82  02 0f 00 30 82 02 0a 02   ...........0....  
  01a0:  82 02 01 00 d3 f5 ce 7a  83 37 67 f1 87 ed 61 25   .......z.7g...a%  
  01b0:  08 52 6e a2 89 11 92 95  94 55 37 26 7b 1b 36 f0   .Rn......U7&{.6.  
  01c0:  96 d8 77 66 b3 fe d1 3d  dc d8 2c df b6 04 2b 2a   ..wf...=..,...+*  
  01d0:  55 ce 46 29 5b 10 66 c9  88 aa 14 9c db 75 dd d2   U.F)[.f......u..  
  01e0:  08 28 9f ce f5 b3 bb bc  87 a0 2f 82 34 18 44 d2   .(......../.4.D.  
  01f0:  b9 49 fd 81 e1 f2 96 c2  32 4f 74 61 c8 ae ca 04   .I......2Ota....  
  0200:  60 5f 97 02 04 bc ee 2d  81 53 9c 82 66 77 5c ae   `_.....-.S..fw\.  
  0210:  3d 18 c3 42 98 3e 0d 42  97 84 68 9f ea 3f fc 99   =..B.>.B..h..?..  
  0220:  7a b4 68 5f fa 0e 99 a7  76 a5 5c c5 a9 4f 4f b5   z.h_....v.\..OO.  
  0230:  88 64 b2 f0 e3 37 21 c0  83 c1 2b b5 ba 90 68 63   .d...7!...+...hc  
  0240:  c4 9b fe 8d ce 7d da d4  f8 e1 55 0b 25 14 24 10   .....}....U.%.$.  
  0250:  fc 16 50 ec 3d b5 1f d8  4a c7 12 3f 32 0d 91 c0   ..P.=...J..?2...  
  0260:  ae ae a0 17 d5 89 3c 81  3f d0 31 e1 c7 86 78 90   ......<.?.1...x.  
  0270:  ca 80 82 03 80 bb dc 1b  fa 60 5c 55 a3 41 e5 50   .........`\U.A.P  
  0280:  10 b5 c0 80 08 2f 1e 60  fe 8a 7f 5a 53 9c 8b 48   ...../.`...ZS..H  
  0290:  f6 f6 be 41 da 78 bf 7d  97 87 75 05 53 cb bd 53   ...A.x.}..u.S..S  
  02a0:  ad 9c 12 db ab d8 91 31  8a 58 93 cc 64 80 6f 3c   .......1.X..d.o<  
  02b0:  0a a1 74 9e 34 91 65 c7  5f e3 61 a6 7a cd 7a ab   ..t.4.e._.a.z.z.  
  02c0:  f5 f4 d6 4c 40 f2 f0 45  33 89 36 59 33 54 fc 5c   ...L at ..E3.6Y3T.\  
  02d0:  28 b2 78 19 17 ac f2 d1  93 4b b7 2c f6 95 c7 86   (.x......K.,....  
  02e0:  44 4b cf 8f bd 6c 99 1c  0e 94 a7 00 46 af 86 e7   DK...l......F...  
  02f0:  95 83 83 77 4c 80 b1 c6  f0 0e 81 2a 02 12 98 12   ...wL......*....  
  0300:  ff f5 3f 17 e0 c1 b2 84  7b 53 7e 8e f9 53 73 8a   ..?.....{S~..Ss.  
  0310:  de f2 19 65 b7 fe 56 45  d0 05 a2 03 04 84 11 2d   ...e..VE.......-  
  0320:  0d 0b 5f 52 34 c1 22 4a  40 c2 e7 d1 b7 95 cc a7   .._R4."J at .......  
  0330:  59 38 cf 0f 79 d1 ad 14  14 65 c1 27 60 36 b8 84   Y8..y....e.'`6..  
  0340:  e8 37 96 ea cd 61 8e 9a  71 b0 c0 2c 68 e3 a7 b4   .7...a..q..,h...  
  0350:  0b 7a cc 71 44 65 14 ac  9d bc 54 f6 01 8e 16 61   .z.qDe....T....a  
  0360:  fb 88 ab ae f7 80 cc 1f  40 87 ab 5e 9b d8 d6 37   ........ at ..^...7  
  0370:  3a c5 2f 5b 5f 80 cf 62  b6 93 80 5f 7b 5f ef 6d   :./[_..b..._{_.m  
  0380:  cb 8e ef 67 c9 c2 78 37  bb 3e b0 ee a3 07 8a ab   ...g..x7.>......  
  0390:  b7 02 76 b6 a0 18 7d 37  cc 54 44 e4 e5 ad 3e f0   ..v...}7.TD...>.  
  03a0:  97 34 76 c7 02 03 01 00  01 a3 82 01 ca 30 82 01   .4v..........0..  
  03b0:  c6 30 0f 06 03 55 1d 13  01 01 ff 04 05 30 03 01   .0...U.......0..  
  03c0:  01 00 30 1d 06 03 55 1d  25 04 16 30 14 06 08 2b   ..0...U.%..0...+  
  03d0:  06 01 05 05 07 03 01 06  08 2b 06 01 05 05 07 03   .........+......  
  03e0:  02 30 0e 06 03 55 1d 0f  01 01 ff 04 04 03 02 05   .0...U..........  
  03f0:  a0 30 33 06 03 55 1d 1f  04 2c 30 2a 30 28 a0 26   .03..U...,0*0(.&  
  0400:  a0 24 86 22 68 74 74 70  3a 2f 2f 63 72 6c 2e 67   .$."http://crl.g  
  0410:  6f 64 61 64 64 79 2e 63  6f 6d 2f 67 64 73 31 2d   odaddy.com/gds1-  
  0420:  32 36 2e 63 72 6c 30 4d  06 03 55 1d 20 04 46 30   26.crl0M..U. .F0  
  0430:  44 30 42 06 0b 60 86 48  01 86 fd 6d 01 07 17 01   D0B..`.H...m....  
  0440:  30 33 30 31 06 08 2b 06  01 05 05 07 02 01 16 25   0301..+........%  
  0450:  68 74 74 70 73 3a 2f 2f  63 65 72 74 73 2e 67 6f   https://certs.go  
  0460:  64 61 64 64 79 2e 63 6f  6d 2f 72 65 70 6f 73 69   daddy.com/reposi  
  0470:  74 6f 72 79 2f 30 81 80  06 08 2b 06 01 05 05 07   tory/0....+.....  
  0480:  01 01 04 74 30 72 30 24  06 08 2b 06 01 05 05 07   ...t0r0$..+.....  
  0490:  30 01 86 18 68 74 74 70  3a 2f 2f 6f 63 73 70 2e   0...http://ocsp.  
  04a0:  67 6f 64 61 64 64 79 2e  63 6f 6d 2f 30 4a 06 08   godaddy.com/0J..  
  04b0:  2b 06 01 05 05 07 30 02  86 3e 68 74 74 70 3a 2f   +.....0..>http:/  
  04c0:  2f 63 65 72 74 69 66 69  63 61 74 65 73 2e 67 6f   /certificates.go  
  04d0:  64 61 64 64 79 2e 63 6f  6d 2f 72 65 70 6f 73 69   daddy.com/reposi  
  04e0:  74 6f 72 79 2f 67 64 5f  69 6e 74 65 72 6d 65 64   tory/gd_intermed  
  04f0:  69 61 74 65 2e 63 72 74  30 1f 06 03 55 1d 23 04   iate.crt0...U.#.  
  0500:  18 30 16 80 14 fd ac 61  32 93 6c 45 d6 e2 ee 85   .0.....a2.lE....  
  0510:  5f 9a ba e7 76 99 68 cc  e7 30 3d 06 03 55 1d 11   _...v.h..0=..U..  
  0520:  04 36 30 34 82 16 4c 42  53 44 32 2e 73 75 6d 6d   .604..LBSD2.summ  
  0530:  69 74 6e 6a 68 6f 6d 65  2e 63 6f 6d 82 1a 77 77   itnjhome.com..ww  
  0540:  77 2e 4c 42 53 44 32 2e  73 75 6d 6d 69 74 6e 6a   w.LBSD2.summitnj  
  0550:  68 6f 6d 65                                        home              
tls_read: want=311, got=311
  0000:  2e 63 6f 6d 30 1d 06 03  55 1d 0e 04 16 04 14 f4   .com0...U.......  
  0010:  53 6d 01 69 29 86 69 fc  ee 4e d5 94 0c 9a 0e 2c   Sm.i).i..N.....,  
  0020:  00 76 32 30 0d 06 09 2a  86 48 86 f7 0d 01 01 05   .v20...*.H......  
  0030:  05 00 03 82 01 01 00 a8  e3 1c ea 53 86 41 70 63   ...........S.Apc  
  0040:  45 93 45 e2 fc 60 6b 46  e3 c9 a5 52 d3 78 d0 da   E.E..`kF...R.x..  
  0050:  08 b3 2a 97 ef 76 e4 0a  56 f1 8e e5 56 92 35 04   ..*..v..V...V.5.  
  0060:  cb 7b d8 c9 01 bf b4 b9  7d 1a cf 61 68 b0 80 5e   .{......}..ah..^  
  0070:  54 f4 30 f3 e5 1a 26 22  a9 c3 72 64 b6 b9 2c 6f   T.0...&"..rd..,o  
  0080:  1c 55 16 14 fe eb 71 d9  69 ae 6f 89 5b 7d 33 24   .U....q.i.o.[}3$  
  0090:  33 a3 33 54 63 e0 79 c5  bb c5 94 a6 2d 0b 4e f8   3.3Tc.y.....-.N.  
  00a0:  2c e9 b0 59 b3 b3 b4 18  c7 6d ff 13 c3 5a 3e 0e   ,..Y.....m...Z>.  
  00b0:  0e 34 6b 40 73 6d bf e6  9c 70 30 95 7b e2 ac 6d   .4k at sm...p0.{..m  
  00c0:  c8 58 92 e4 ca 26 be 65  a7 db 61 b3 41 8f 0e c9   .X...&.e..a.A...  
  00d0:  5d 0a c8 8d 5d 3a 1b b1  5e e9 0a 3f d8 a9 58 ab   ]...]:..^..?..X.  
  00e0:  af 65 41 aa d7 47 47 34  96 f2 13 6d a3 db 9d e2   .eA..GG4...m....  
  00f0:  72 96 d3 87 34 25 92 eb  96 38 5f 7c f8 2d e1 e4   r...4%...8_|.-..  
  0100:  26 ce f3 ba f4 fb 89 65  06 50 8c 2e ee 28 e4 c7   &......e.P...(..  
  0110:  e3 2a b1 50 44 b8 91 ed  f5 c4 5f 9c dd c6 55 f7   .*.PD....._...U.  
  0120:  0f 7f e5 5d f2 ae 10 ef  f4 ef c5 38 e7 c7 dc 85   ...].......8....  
  0130:  1e 01 a3 1b f6 d4 f6                               .......           
TLS certificate verification: depth: 0, err: 20, subject: /O=LBSD2.summitnjhome.com/OU=Domain Control Validated/CN=LBSD2.summitnjhome.com, issuer: /C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=07969287
TLS certificate verification: Error, unable to get local issuer certificate
tls_write: want=7, written=7
  0000:  15 03 01 00 02 02 30                               ......0           
TLS trace: SSL3 alert write:fatal:unknown CA
TLS trace: SSL_connect:error in SSLv3 read server certificate B
TLS trace: SSL_connect:error in SSLv3 read server certificate B
TLS: can't connect.
ldap_perror
ldap_start_tls: Connect error (-11)
	additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
Enter LDAP Password: 
ldap_pvt_sasl_getmech
ldap_search
put_filter: "(objectclass=*)"
put_filter: simple
put_simple_filter: "objectclass=*"
ldap_build_search_req ATTRS:
    supportedSASLMechanisms
ldap_send_initial_request
ldap_send_server_request
ber_scanf fmt ({it) ber:
ber_dump: buf=0xa099bc8 ptr=0xa099bc8 end=0xa099c08 len=64
  0000:  30 3e 02 01 02 63 39 04  00 0a 01 00 0a 01 00 02   0>...c9.........  
  0010:  01 00 02 01 00 01 01 00  87 0b 6f 62 6a 65 63 74   ..........object  
  0020:  63 6c 61 73 73 30 19 04  17 73 75 70 70 6f 72 74   class0...support  
  0030:  65 64 53 41 53 4c 4d 65  63 68 61 6e 69 73 6d 73   edSASLMechanisms  
ber_scanf fmt ({) ber:
ber_dump: buf=0xa099bc8 ptr=0xa099bcd end=0xa099c08 len=59
  0000:  63 39 04 00 0a 01 00 0a  01 00 02 01 00 02 01 00   c9..............  
  0010:  01 01 00 87 0b 6f 62 6a  65 63 74 63 6c 61 73 73   .....objectclass  
  0020:  30 19 04 17 73 75 70 70  6f 72 74 65 64 53 41 53   0...supportedSAS  
  0030:  4c 4d 65 63 68 61 6e 69  73 6d 73                  LMechanisms       
ber_flush: 64 bytes to sd 3
  0000:  30 3e 02 01 02 63 39 04  00 0a 01 00 0a 01 00 02   0>...c9.........  
  0010:  01 00 02 01 00 01 01 00  87 0b 6f 62 6a 65 63 74   ..........object  
  0020:  63 6c 61 73 73 30 19 04  17 73 75 70 70 6f 72 74   class0...support  
  0030:  65 64 53 41 53 4c 4d 65  63 68 61 6e 69 73 6d 73   edSASLMechanisms  
ldap_write: want=64, written=64
  0000:  30 3e 02 01 02 63 39 04  00 0a 01 00 0a 01 00 02   0>...c9.........  
  0010:  01 00 02 01 00 01 01 00  87 0b 6f 62 6a 65 63 74   ..........object  
  0020:  63 6c 61 73 73 30 19 04  17 73 75 70 70 6f 72 74   class0...support  
  0030:  65 64 53 41 53 4c 4d 65  63 68 61 6e 69 73 6d 73   edSASLMechanisms  
ldap_result ld 0xa028530 msgid 2
wait4msg ld 0xa028530 msgid 2 (infinite timeout)
wait4msg continue ld 0xa028530 msgid 2 all 1
** ld 0xa028530 Connections:
* host: ldap  port: 389  (default)
  refcnt: 2  status: Connected
  last used: Sun Nov 28 12:40:00 2010

** ld 0xa028530 Outstanding Requests:
 * msgid 2,  origid 2, status InProgress
   outstanding referrals 0, parent count 0
** ld 0xa028530 Response Queue:
   Empty
ldap_chkResponseList ld 0xa028530 msgid 2 all 1
ldap_chkResponseList returns ld 0xa028530 NULL
ldap_int_select
read1msg: ld 0xa028530 msgid 2 all 1
ber_get_next
ldap_read: want=8, got=8
  0000:  16 03 01 00 04 0e 00 00                            ........          
ber_get_next failed.
ldap_perror
ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1)
	additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed