[Pkg-openldap-devel] Bug#555409: ldap-utils: Untrusted LDAP server SSL certs result in misleading error message

[The Jorginator]

Package: ldap-utils
Version: 2.4.11-1
Severity: minor

Background: We are trying to make use of LDAP over SSL with our own internal CA
certificate (not customer-facing stuff, so internal CA will suffice.)

When doing e.g.:
   ldapsearch -H ldaps://ldap.example.com -x uid=karl
this fails with:
   ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)

when the real problem seems to be that the server certificate is not trusted.

Once our CA certificate was added in /etc/ssl/certs (with symlink etc) on the
client, ldap-search works fine. Removing the entries from /etc/ssl/certs
reverts back to the old behaviour.

My point: The error message is misleading - it took me a while to debug this,
as the error message points towards lack of connectivity, DNS, firewalls or
other red herrings...

Could we have a better error message for this?

If not, the at least others with the same problem might come across this in
their favourite search engine...

-- System Information:
Debian Release: 5.0.3
  APT prefers stable
  APT policy: (500, 'stable')
Architecture: i386 (i686)

Kernel: Linux 2.6.26-2-vserver-686 (SMP w/2 CPU cores)
Locale: LANG=en_GB, LC_CTYPE=en_GB (charmap=ISO-8859-1)
Shell: /bin/sh linked to /bin/bash

Versions of packages ldap-utils depends on:
ii  libc6             2.7-18                 GNU C Library: Shared libraries
ii  libgnutls26       2.4.2-6+lenny1         the GNU TLS library - runtime libr
ii  libldap-2.4-2     2.4.11-1               OpenLDAP libraries
ii  libsasl2-2        2.1.22.dfsg1-23+lenny1 Cyrus SASL - authentication abstra

Versions of packages ldap-utils recommends:
ii  libsasl2-modules  2.1.22.dfsg1-23+lenny1 Cyrus SASL - pluggable authenticat

ldap-utils suggests no packages.

-- no debconf information