One downside of having to do non-work email on my phone while at work is
that I didn't realize my reply to Quanah was direct, not to the list.
Sorry about that. Trying again:
I did the following to try to answer
$ ldd /usr/bin/ldapsearch.exe # 2.4.42
ntdll.dll => /cygdrive/c/WINDOWS/SYSTEM32/ntdll.dll (0x7ffc58b50000)
KERNEL32.DLL => /cygdrive/c/WINDOWS/System32/KERNEL32.DLL
(0x7ffc57bd0000)
KERNELBASE.dll => /cygdrive/c/WINDOWS/System32/KERNELBASE.dll
(0x7ffc554b0000)
SYSFER.DLL => /cygdrive/c/WINDOWS/System32/SYSFER.DLL (0x59e30000)
ADVAPI32.dll => /cygdrive/c/WINDOWS/System32/ADVAPI32.dll
(0x7ffc57b20000)
msvcrt.dll => /cygdrive/c/WINDOWS/System32/msvcrt.dll
(0x7ffc57950000)
sechost.dll => /cygdrive/c/WINDOWS/System32/sechost.dll
(0x7ffc563a0000)
RPCRT4.dll => /cygdrive/c/WINDOWS/System32/RPCRT4.dll
(0x7ffc581d0000)
cygwin1.dll => /usr/bin/cygwin1.dll (0x180040000)
cyglber-2-4-2.dll => /usr/bin/cyglber-2-4-2.dll (0x3fbd60000)
cygsasl2-3.dll => /usr/bin/cygsasl2-3.dll (0x3faae0000)
cygldap-2-4-2.dll => /usr/bin/cygldap-2-4-2.dll (0x3fb9b0000)
cygcrypto-1.0.0.dll => /usr/bin/cygcrypto-1.0.0.dll (0x3fe480000)
cygz.dll => /usr/bin/cygz.dll (0x3fa000000)
cygssl-1.0.0.dll => /usr/bin/cygssl-1.0.0.dll (0x3fa860000)
And
$ ldd /usr/bin/ldapsearch.exe # 2.4.48
ntdll.dll => /cygdrive/c/WINDOWS/SYSTEM32/ntdll.dll (0x7ffc58b50000)
KERNEL32.DLL => /cygdrive/c/WINDOWS/System32/KERNEL32.DLL
(0x7ffc57bd0000)
KERNELBASE.dll => /cygdrive/c/WINDOWS/System32/KERNELBASE.dll
(0x7ffc554b0000)
SYSFER.DLL => /cygdrive/c/WINDOWS/System32/SYSFER.DLL (0x59e30000)
ADVAPI32.dll => /cygdrive/c/WINDOWS/System32/ADVAPI32.dll
(0x7ffc57b20000)
msvcrt.dll => /cygdrive/c/WINDOWS/System32/msvcrt.dll
(0x7ffc57950000)
sechost.dll => /cygdrive/c/WINDOWS/System32/sechost.dll
(0x7ffc563a0000)
RPCRT4.dll => /cygdrive/c/WINDOWS/System32/RPCRT4.dll
(0x7ffc581d0000)
cygwin1.dll => /usr/bin/cygwin1.dll (0x180040000)
cyglber-2-4-2.dll => /usr/bin/cyglber-2-4-2.dll (0x3fbd60000)
cygsasl2-3.dll => /usr/bin/cygsasl2-3.dll (0x3faae0000)
cygldap-2-4-2.dll => /usr/bin/cygldap-2-4-2.dll (0x3fb9b0000)
cygssl-1.1.dll => /usr/bin/cygssl-1.1.dll (0x3fa7d0000)
??? => ??? (0xe80000)
cygcrypto-1.1.dll => /usr/bin/cygcrypto-1.1.dll (0x3fe210000)
cygz.dll => /usr/bin/cygz.dll (0x3fa000000)
So something seems weird with one showing cygssl 1.1 and maybe something
missing while the working one shows cygssl 1.0. any idea how I might
resolve that?
Thanks
--
Dave Goldberg
dsg18...@gmail.com
On Fri, Aug 2, 2019 at 1:28 PM Quanah Gibson-Mount <qua...@symas.com> wrote:
> --On Friday, August 02, 2019 12:45 PM -0400 David Goldberg
> <dsg18...@gmail.com> wrote:
>
> > I updated openldap from 2.4.42-1 to 2.4.48-1 this morning and now
> > ldapsearch will not connect, complaining that the server provided
> > certificate is self signed. I have set up /etc/pki with my company's
> > certificate chain and that allows 2.4.42-1 (and earlier) and other
> > applications to properly authenticate local services. What has changed in
> > 2.4.48-1 that causes this to not work and how can I fix it. I've
> > downgraded for now; that is not a good long term solution of course.
>
> What SSL library is being used for each of the two builds (I.e., gnutls?
> openssl? moznss?) What SSL library version did 2.4.42 link to? What SSL
> library version does 2.4.48 link to? Generally OpenLDAP should be linked
> to OpenSSL which uses PEM formatted certificates. Also check whether you
> have a global ldap.conf file (usually something like
> /etc/openldap/ldap.conf or /etc/ldap.conf, etc, depending on how OpenLDAP
> was built) that defines where to find the CA Cert(s), or a ~user/.ldaprc,
> etc. OpenLDAP client utilities generally by default do not search for a
> global list of CA certificates.
>
> --Quanah
>
> --
>
> Quanah Gibson-Mount
> Product Architect
> Symas Corporation
> Packaged, certified, and supported LDAP solutions powered by OpenLDAP:
> <http://www.symas.com>
>
>
--
Problem reports: http://cygwin.com/problems.html
FAQ: http://cygwin.com/faq/
Documentation: http://cygwin.com/docs.html
Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
