<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
AFAIK, PHP ldaps's it's primarily built around openldap, so you
need to put the CA cert in the openldap directory default's.<br>
Normally i compile myself the libraries, and even php, so this
default can change in the CSW repository, but usually you can
find/define that directory into the openldap.conf (probably under
/etc/somewhere or /opt/somewhere, mine it's under
/opt/openldap/etc/openldap) and inside you can write:<br>
<br>
TLS_CACERTDIR /every/path/you/want<br>
<br>
and putting there the CA certificates you want check against.
Remember to do the cert hash listing to get sure that the cacerts
are found.<br>
<br>
Hope this clarify.<br>
<br>
<div class="moz-cite-prefix">Il 23/01/2013 21:33, John Thurston ha
scritto:<br>
</div>
<blockquote cite="mid:51004916.2060204@alaska.gov" type="cite">
<pre wrap="">I have the application running but am unable to get ldaps working. It is
failing to validate the certificate:
</pre>
<blockquote type="cite">
<pre wrap="">Warning: ldap_start_tls(): Unable to start TLS: Connect error in /opt/ZendTo/lib/NSSLDAPAuthenticator.php
</pre>
</blockquote>
<pre wrap="">and
</pre>
<blockquote type="cite">
<pre wrap="">TLS: can't connect: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed (self signed certificate in certificate chain).
</pre>
</blockquote>
<pre wrap="">
I'm running Solaris 10 and have used opencsw packages for:
CSWapache2
CSWap2-modphp5
CSWap2-modphp5
CSWphp5-sqlite
CSWphp5-ldap
CSWphp5-json
CSWphp5-pdosqlite
CSWphp5-openssl
CSWopenldap-client
with openssl, I can validate the cert on the directory server:
</pre>
<blockquote type="cite">
<pre wrap=""> openssl s_client -connect ldap.foo.us:636 -CApath /opt/csw/ssl/certs
</pre>
</blockquote>
<pre wrap="">
but openssl will not validate the cert without the -CApath option. This
makes me think that PHP is also ignorant of where to find the root
certificates.
I can't figure out how or where to tell PHP to look at this directory of
hashed root certificates. Am I barking up the wrong tree? Can anyone
give me a clue?
</pre>
</blockquote>
<br>
<div class="moz-signature">-- <br>
<center>
<span style="font-family: Verdana, sans-serif;font-weight:
bold;">
ing. Sergio Rabellino<br>
</span>
<br>
<span style="font-family: Verdana, sans-serif;">
Università degli Studi di Torino<br>
Dipartimento di Informatica<br>
ICT Services Coordinator<br>
Tel +39-0116706701
Fax +39-011751603<br>
C.so Svizzera , 185 - 10149 - Torino<br>
<br>
<a href="http://www.di.unito.it" alt="Dipartimento di
Informatica"><img
src="cid:part1.03080000.01040203@di.unito.it" border="0"></a>
</span>
</center>
</div>
</body>
</html>