Bug #73558 [Com]: LDAP_OPT_X_TLS_CACERTFILE silently ignored
Edit report at https://bugs.php.net/bug.php?id=73558&edit=1
ID: 73558
Comment by: jimp at netgate dot com
Reported by: jmaguire at duo dot com
Summary: LDAP_OPT_X_TLS_CACERTFILE silently ignored
Status: No Feedback
Type: Bug
Package: LDAP related
Operating System: Linux
PHP Version: 7.1.0RC6
Assigned To: heiglandreas
Block user comment: N
Private report: N
New Comment:
I've been experimenting with this and it doesn't appear to have any effect on PHP 7.3
running under PHP-FPM on FreeBSD (11.x or 12.x), and OpenSSL 1.0 or 1.1.1 didn't make a
difference either.
I can only make a successful LDAP connection with a self-signed CA when using putenv() to set
LDAPTLS_REQCERT/LDAPTLS_CACERTDIR/LDAPTLS_CACERT. If I try using ldap_set_option(), the only result
is failure with a packet capture showing an "unknown CA" error being sent back to the
server.
I was using it this way:
ldap_set_option($ldap, LDAP_OPT_X_TLS_REQUIRE_CERT, LDAP_OPT_X_TLS_HARD);
ldap_set_option($ldap, LDAP_OPT_X_TLS_CACERTDIR, "/var/certs/");
ldap_set_option($ldap, LDAP_OPT_X_TLS_CACERTFILE, "/var/certs/blah.ca");
Previous Comments:
------------------------------------------------------------------------
[2019-01-15 21:20:58] theodorejb at outlook dot com
I'm also having this issue on Windows with PHP 7.3.0.
------------------------------------------------------------------------
[2018-12-03 10:54:53] mail at ckristo dot net
Hi,
We have an internal CA which we need to add in order to establish a LDAPS connetion successfully. On
our setup, we encounter the same issue, it seems that ldap_set_option($ldap,
LDAP_OPT_X_TLS_CACERTFILE, '<val>') and ldap_set_option($ldap,
LDAP_OPT_X_TLS_CACERTDIR, '<val>') are completely ignored. When setting the
same paths via .ldaprc, PHP LDAP works fine.
Best regards,
Chris
------------------------------------------------------------------------
[2017-01-22 04:22:52] php-bugs at lists dot php dot net
No feedback was provided. The bug is being suspended because
we assume that you are no longer experiencing the problem.
If this is not the case and you are able to provide the
information that was requested earlier, please do so and
change the status of the bug back to "Re-Opened". Thank you.
------------------------------------------------------------------------
[2017-01-10 07:48:05] heiglandreas@php.net
There seems to be an issue with that setting in the underlying OpenLDAP-library that ignores
LDAP_OPT_X_TLS_CACERTFILE when LDAP_OPT_X_TLS_CACERTDIR is not set[1].
Could you check whether setting that second option makes a difference?
[1] http://www.openldap.org/lists/openldap-software/200401/msg00777.html
------------------------------------------------------------------------
[2016-11-18 15:19:12] cmb@php.net
Thanks for the quick feedback!
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=73558
--
Edit this bug report at https://bugs.php.net/bug.php?id=73558&edit=1
Thread (10 messages)