centos 6.6 ldapauthentication在ldap主机上更新证书后不再起作用

我们最近更新了我们的LDAP主机上的CA证书。 有几个CentOS 5.x服务器似乎没有任何问题对LDAP主机进行身份validation，但有一个Centos 6.6服务器无法使用。 我不知道服务器是如何configuration的，系统pipe理员离开时没有留下太多的文档。 ldapsearch客户端似乎没有任何问题。 当我运行ldapsearch最详细的debugging输出，我没有看到任何错误：

$ ldapsearch -h ldap.hostname.com -x -LLL -v -d 167 -s base -b "" 2>&1 | grep -i error res_errno: 0, res_error: <>, res_matched: <> res_errno: 0, res_error: <>, res_matched: <> 

以下是openssl s_client实用程序的输出：

 $ openssl s_client -connect ldap.hostname.com:636 < /dev/null CONNECTED(00000003) depth=3 C = SE, O = AddTrust AB, OU = AddTrust External TTP Network, CN = AddTrust External CA Root verify return:1 depth=2 C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust RSA Certification Authority verify return:1 depth=1 C = US, ST = MI, L = Ann Arbor, O = Internet2, OU = InCommon, CN = InCommon RSA Server CA verify return:1 depth=0 C = , postalCode = , ST = , L = , street = , O = , OU = , CN = ldap.hostname.com verify return:1 --- Certificate chain 0 s:/C=US/postalCode=/ST=/L=/street=/OU=/CN=ldap.hostname.com i:/C=US/ST=MI/L=Ann Arbor/O=Internet2/OU=InCommon/CN=InCommon RSA Server CA 1 s:/C=US/ST=MI/L=Ann Arbor/O=Internet2/OU=InCommon/CN=InCommon RSA Server CA i:/C=US/ST=New Jersey/L=Jersey City/O=The USERTRUST Network/CN=USERTrust RSA Certification Authority 2 s:/C=US/ST=New Jersey/L=Jersey City/O=The USERTRUST Network/CN=USERTrust RSA Certification Authority i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root 3 s:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root --- Server certificate -----BEGIN CERTIFICATE----- [...] -----END CERTIFICATE----- subject=/C=/postalCode=/ST=/L=/street=/O=/OU=/CN=ldap.hostname.com issuer=/C=US/ST=MI/L=Ann Arbor/O=Internet2/OU=InCommon/CN=InCommon RSA Server CA --- No client certificate CA names sent --- SSL handshake has read 5715 bytes and written 607 bytes --- New, TLSv1/SSLv3, Cipher is AES256-SHA256 Server public key is 2048 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1.2 Cipher : AES256-SHA256 Session-ID: [...] Session-ID-ctx: Master-Key: [...] Key-Arg : None Krb5 Principal: None PSK identity: None PSK identity hint: None Start Time: [...] Timeout : 300 (sec) Verify return code: 0 (ok) --- DONE 

当我在debugging模式下运行nslcd时，发现以下错误：

 $ sudo nslcd -d -d -d 2>&1 > nslcd.log $ cat nslcd.log | grep -i error res_errno: 0, res_error: <>, res_matched: <> TLS: cannot open certdb '/etc/openldap/cacerts', error -8018:Unknown PKCS #11 error. TLS: certificate [...] is not valid - error -8172:Peer's certificate issuer has been marked as not trusted by the user.. TLS: error: connect - force handshake failure: errno 0 - moznss error -8172 TLS: can't connect: TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user.. nslcd: [8b4567] ldap_start_tls_s() failed: Connect error (uri="ldap://ldap.hostname.com/") nslcd: [8b4567] failed to bind to LDAP server ldap://ldap.hostname.com/: Connect error res_errno: 0, res_error: <>, res_matched: <> [...] 

这里是/etc/ldap.conf的内容：

• 在本地networkingapache2上不要使用Client Cert Auth
• AWS :: Ubuntu实例始终拒绝我的私钥
• AWS EC2服务器拒绝连接 – 未安装replace的authorized_keys – 仍然无法连接
• 一台计算机无法对TFS或Exchange进行身份validation
• Windows需要很长时间才能通过networking访问其他PC

 base o=org timelimit 120 bind_timelimit 120 idle_timelimit 3600 nss_initgroups_ignoreusers root,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman,nscd,gdm nss_map_attribute uniqueMember member nss_base_passwd ou=People,?one nss_base_group ou=Group,?one tls_cert tls_key uri ldap://ldap.hostname.com ssl start_tls TLS_CACERTDIR /etc/openldap/certs pam_password md5 SUDOERS_BASE ou=SUDOers,o=org 

这里是/etc/openldap/ldap.conf的内容：

 TLS_CACERTDIR /etc/openldap/certs URI ldap://ldap.hostname.com/ BASE o=org 

这里是/etc/nslcd.conf的内容：

 uid nslcd gid ldap uri ldap://ldap.hostname.com/ base o=org ssl start_tls tls_cacertdir /etc/openldap/cacerts tls_cacertfile /etc/openldap/cacerts/authconfig_downloaded.pem 

我search了错误消息，但是我已经在网上find的所有不同的LDAP文档中有点不知所措了。 任何build议将不胜感激。