Problem:
Secure LDAP queries via command-line and PHP to an AD domain controller with a self-signed certificate.
Background:
I am working on a project where I need to enable LDAP look-ups from a PHP web application to a MS AD domain controller that is using a self-signed certificate. This self-signed certificate is also using a domain name that is not a FQDN – think of something like people.campus as the domain name. The web application would take the user's credentials and pass them on to the AD domain controller to verify if the credntials are a match or not. This seems simple, but I am having problems trying to get PHP and the self-signed certificate to work.
Some people have suggested that I changed the TLS_REQCERT variable from "request" to "never" within the OpenLDAP configuration. I am concerned that this might have larger implications such as a man-in-the-middle attack and I am not comfortable changing this setting to never. I have also read some places online where one can take a certificate and place it as a trusted source within the openldap configuration file. I am curious if that is something that I could do for the situation that I have? Can I, from the command line, obtain the self-signed certificate that the AD domain controller is using, save it to a file, and then have openldap use that file for the trust that it needs so that I do not need to adjust the variable from request to never? I do not have access to the AD domain controller and as a result cannot export the certificate. If there is a way to obtain the certificate from the command line, what commands do I need to use? Is there an alternate method of handling this issue that would be better in the long run? I have some CentOS servers and some Ubuntu servers that I am working with to try and get this going on.
Thanks in advance for your help and ideas.
Best Answer
If your self-signed certificate is signed by your owned authority, you can check if the certificate provided is correct by check the server cert. To do this, add in your ldap.conf the line 'TLS_CACERT /etc/ssl/certs/ca.pem' with ca.pem is the file with public key of your authority. With 'TLS_REQCERT hard', it will check your connection, and refuse to speak if your certificate server is incorrect.
If you have just the certificate, you can MAYBE (I don't try) add your public key to TLS_CERT/TLS_CACERT.