为 LDAPS 连接验证自签名证书

2022-01-17 00:00:00 ssl-certificate ldap active-directory php client-certificates

我想建立一个从 Linux(Linux 3.2.0-4-amd64 #1 SMP Debian 3.2.51-1 x86_64 GNU/Linux) 客户端到 Windows 2012 服务器的安全 ldap 连接 (ldaps)，以更改用户活动目录中的密码，通过 php.为此，我在服务器上创建了一个自签名证书(使用 Windows 服务器管理器)，但是当我尝试连接时，我收到以下错误(通过打开调试选项:ldap_set_option(NULL, LDAP_OPT_DEBUG_LEVEL, 7);):

I want to make a secure ldap connection(ldaps) from a Linux(Linux 3.2.0-4-amd64 #1 SMP Debian 3.2.51-1 x86_64 GNU/Linux) client to a Windows 2012 server, to change user passwords in active directory, through php. For that, I've created a self-signed certificate(using Windows Server Manager) on the server, but when I try to connect, I get the following error(by turning debugging option on: ldap_set_option(NULL, LDAP_OPT_DEBUG_LEVEL, 7);):

ldap_create                                                                 
ldap_url_parse_ext(ldaps://xxx.xxx.xxx.xxx)                                 
ldap_bind_s                                                                 
ldap_simple_bind_s                                                          
ldap_sasl_bind_s                                                            
ldap_sasl_bind                                                              
ldap_send_initial_request                                                   
ldap_new_connection 1 1 0                                                   
ldap_int_open_connection                                                    
ldap_connect_to_host: TCP xxx.xxx.xxx.xxx:636                               
ldap_new_socket: 3                                                          
ldap_prepare_socket: 3                                                      
ldap_connect_to_host: Trying xxx.xxx.xxx.xxx:636                            
ldap_pvt_connect: fd: 3 tm: -1 async: 0                                     
TLS: peer cert untrusted or revoked (0x42)                                  
TLS: can't connect: (unknown error code).                                   
ldap_err2string                                                             
PHP Warning:  ldap_bind(): Unable to bind to server

似乎客户端无法信任证书，因为它是自签名的.

It seems the client is not able to trust the certificate since it's self-signed.

我应该采取哪些步骤来建立安全连接?客户端证书存储在 /etc/ssl/certs/ca-certificates.crt

What steps should I take to make a secure connection? The client side certificates are stored in /etc/ssl/certs/ca-certificates.crt

推荐答案

您必须明确告诉 LDAP 客户端忽略不受信任的证书.您可以通过将以下内容添加到您的 ldap.conf 文件来做到这一点:

You have to explicitly tell the LDAP client to ignore untrusted certificates. You can do so by adding the following to your ldap.conf file:

TLS_REQCERT never

虽然这个解决方案不是首选的.您应该将所需的 CA 根添加到您的客户端，并确保正确生成证书，其中包含服务器的名称(如果我没记错的话，完整的 CA 链)，否则没有什么可以阻止某人执行 MITM 攻击.

This solution is not the preferred one though. You should add the required CA root to your client and ensure that the certificate is correctly generated with the server's name in it (and if my memory serves me right the complete CA chain) otherwise nothing would stop someone to perform a MITM attack.

相关文章