CentOS7下slapd启动失败：main: TLS init def ctx failed: -1求助

环境信息 #

节点系统版本：

cat /etc/redhat-release
CentOS Linux release 7.8.2003 (Core)

清理旧OpenLDAP环境 #

执行以下命令清理未完成配置的旧OpenLDAP：

systemctl stop slapd
systemctl disable slapd
yum -y remove openldap-servers openldap-clients 
rm -rf /var/lib/ldap
userdel ldap
rm -rf /etc/openldap

重新安装OpenLDAP #

通过yum重装OpenLDAP包：

yum install openldap openldap-servers -y
yum install openldap-clients -y

rpm -qa | grep openldap
openldap-2.4.44-25.el7_9.x86_64
openldap-servers-2.4.44-25.el7_9.x86_64
openldap-devel-2.4.44-25.el7_9.x86_64
openldap-clients-2.4.44-25.el7_9.x86_64

启动slapd失败的错误信息 #

启动服务失败：

systemctl start slapd
Job for slapd.service failed because the control process exited with error code. See "systemctl status slapd.service" and "journalctl -xe" for details.

查看服务状态：

systemctl status -l slapd.service
● slapd.service - OpenLDAP Server Daemon
   Loaded: loaded (/usr/lib/systemd/system/slapd.service; disabled; vendor preset: disabled)
   Active: failed (Result: exit-code) since Sun 2023-05-14 15:52:24 UTC; 57s ago
     Docs: man:slapd
           man:slapd-config
           man:slapd-hdb
           man:slapd-mdb
           file:///usr/share/doc/openldap-servers/guide.html
  Process: 1037 ExecStart=/usr/sbin/slapd -u ldap -h ${SLAPD_URLS} $SLAPD_OPTIONS (code=exited, status=1/FAILURE)
  Process: 1022 ExecStartPre=/usr/libexec/openldap/check-config.sh (code=exited, status=0/SUCCESS)

May 14 15:52:24 ip-172-26-65-165.support.fuse.asok.com runuser[1025]: pam_unix(runuser:session): session opened for user ldap by (uid=0)
May 14 15:52:24 ip-172-26-65-165.support.fuse.asok.com runuser[1025]: pam_unix(runuser:session): session closed for user ldap
May 14 15:52:24 ip-172-26-65-165.support.fuse.asok.com slapd[1037]: @(#) $OpenLDAP: slapd 2.4.44 (Feb 23 2022 17:11:27) $
                                                                                mockbuild@x86-01.bsys.centos.org:/builddir/build/BUILD/openldap-2.4.44/openldap-2.4.44/servers/slapd
May 14 15:52:24 ip-172-26-65-165.support.fuse.asok.com slapd[1037]: main: TLS init def ctx failed: -1
May 14 15:52:24 ip-172-26-65-165.support.fuse.asok.com slapd[1037]: slapd stopped.
May 14 15:52:24 ip-172-26-65-165.support.fuse.asok.com slapd[1037]: connections_destroy: nothing to destroy.
May 14 15:52:24 ip-172-26-65-165.support.fuse.asok.com systemd[1]: slapd.service: control process exited, code=exited status=1
May 14 15:52:24 ip-172-26-65-165.support.fuse.asok.com systemd[1]: Failed to start OpenLDAP Server Daemon.
May 14 15:52:24 ip-172-26-65-165.support.fuse.asok.com systemd[1]: Unit slapd.service entered failed state.
May 14 15:52:24 ip-172-26-65-165.support.fuse.asok.com systemd[1]: slapd.service failed.

现有TLS配置信息 #

证书文件列表：

ls -l /etc/openldap/certs/
total 12
-rw-r--r--. 1 ldap ldap 1371 May 14 15:27 myCA.pem
-rw-r--r--. 1 ldap ldap 1379 May 14 15:31 OpenLDAP Server
-rw-r--r--. 1 ldap ldap 1675 May 14 15:30 password

文件类型验证：

file /etc/openldap/certs/myCA.pem /etc/openldap/certs/OpenLDAP\ Server /etc/openldap/certs/password
/etc/openldap/certs/myCA.pem:        PEM certificate
/etc/openldap/certs/OpenLDAP Server: PEM certificate
/etc/openldap/certs/password:        PEM RSA private key

slapd配置中的TLS项：

grep -R olcTLS /etc/openldap/slapd.d
/etc/openldap/slapd.d/cn=config.ldif:olcTLSCACertificatePath: /etc/openldap/certs
/etc/openldap/slapd.d/cn=config.ldif:olcTLSCertificateFile: "OpenLDAP Server"
/etc/openldap/slapd.d/cn=config.ldif:olcTLSCertificateKeyFile: /etc/openldap/certs/password

解决方法 #

方法1：彻底清理残留配置并重新初始化 #

如果是旧配置残留导致的问题，彻底清理后重新初始化是最稳妥的方案：

1. 停止并卸载所有OpenLDAP相关包：

   systemctl stop slapd
   yum remove -y openldap*
   

2. 清理所有残留文件和用户：

   rm -rf /var/lib/ldap
   rm -rf /etc/openldap
   userdel -r ldap
   

3. 重新安装OpenLDAP：

   yum install -y openldap openldap-servers openldap-clients
   

4. 初始化默认数据库：

   cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
   chown -R ldap:ldap /var/lib/ldap/
   

5. 启动服务并验证状态：

   systemctl start slapd
   systemctl status slapd
   

方法2：修复现有TLS配置问题 #

如果希望保留现有证书，可针对TLS配置逐一排查修复：

1. 修正证书文件路径与权限：
   • 将olcTLSCertificateFile改为绝对路径（避免相对路径解析问题）
   • 确保私钥文件权限仅对ldap用户可读：

     chmod 600 /etc/openldap/certs/password
     chown -R ldap:ldap /etc/openldap/certs/
     

2. 生成CA证书哈希链接：
   olcTLSCACertificatePath要求目录下的CA证书以哈希链接形式存在，执行以下命令生成：

   cd /etc/openldap/certs
   ln -s myCA.pem $(openssl x509 -hash -noout -in myCA.pem).0
   

3. 更新slapd的TLS配置：
   创建fix-tls.ldif文件：

   dn: cn=config
   changetype: modify
   replace: olcTLSCertificateFile
   olcTLSCertificateFile: /etc/openldap/certs/OpenLDAP Server
   -
   replace: olcTLSCACertificateFile
   olcTLSCACertificateFile: /etc/openldap/certs/myCA.pem
   

   执行配置修改（需确保slapd临时启动，若无法启动可先临时注释TLS配置项后启动，再执行修改）：

   ldapmodify -Y EXTERNAL -H ldapi:/// -f fix-tls.ldif
   

4. 测试TLS连接：
   启动slapd后，执行以下命令验证TLS功能：

   ldapsearch -x -ZZ -H ldap:/// -b "" -s base
   

内容的提问来源于stack exchange，提问作者Aso'K