Oracle Linux客户端无法连接Debian Stretch LDAP主节点，报SSL握手失败

Let’s break down the most likely causes and actionable fixes based on your environment details:

1. Verify TLS Protocol Version Compatibility #

Debian Stretch uses OpenSSL 1.1.0f, which often defaults to disabling older TLS protocols (like TLSv1.0/TLSv1.1) in modern slapd configurations. Oracle Linux 7.4’s OpenSSL 1.0.2k may still try to negotiate these older protocols by default, leading to a handshake failure.

Check Debian Server’s TLS Protocol Settings #

Inspect your slapd TLS configuration to see the minimum allowed protocol version:

ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// -b cn=config olcTLSProtocolMin

If the output shows olcTLSProtocolMin: 3.3 (TLSv1.2) or higher, the server rejects older protocols—this is likely the conflict point.

Fix on Oracle Linux Client #

Edit /etc/openldap/ldap.conf to enforce TLSv1.2:

TLS_PROTOCOL_MIN 3.3

Then test the connection again.

2. Resolve Cipher Suite Mismatch #

OpenSSL 1.1.0 and 1.0.2 have different default cipher suites. The Debian server may be using ciphers that the Oracle client doesn’t support, or vice versa.

Test SSL Connection from Oracle Client #

Run this command on the Oracle Linux node to debug handshake details:

openssl s_client -connect debian:636 -tls1_2

Look for Cipher Suite: in the output. If you see no cipher match, you’ll need to adjust the server’s cipher suite to include ones compatible with OpenSSL 1.0.2k.

Adjust Debian Server’s Cipher Suite #

First, check the current setting:

ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// -b cn=config olcTLSCipherSuite

Update it to include cross-version compatible ciphers:

ldapmodify -Q -Y EXTERNAL -H ldapi:/// <<EOF
dn: cn=config
changetype: modify
replace: olcTLSCipherSuite
olcTLSCipherSuite: ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
EOF

Restart slapd to apply changes:

systemctl restart slapd

3. Validate CA Certificate Installation on Oracle Client #

Ensure the non-self-signed CA certificate is properly trusted:

• Copy the CA cert to /etc/openldap/cacerts/
• Run c_rehash /etc/openldap/cacerts/ to generate hash symlinks
• Verify /etc/openldap/ldap.conf includes:

  TLS_CACERT /etc/openldap/cacerts/your-ca-cert.pem
  

Test trust with:

openssl s_client -connect debian:636 -CAfile /etc/openldap/cacerts/your-ca-cert.pem

Look for Verify return code: 0 (ok) to confirm the cert is trusted.

4. Check Server Certificate Chain Completeness #

On the Debian server, ensure the server certificate includes the full chain (server cert + any intermediate CA certs):

openssl x509 -in /path/to/server-cert.pem -text -noout

If the chain is incomplete, update olcTLSCertificateFile in slapd config to use a combined file containing the server cert followed by intermediate CA certs.

5. Debug OpenLDAP Client Connection #

Test the connection with debug output to uncover remaining issues:

ldapsearch -H ldaps://debian:636 -b "dc=your-domain,dc=com" -D "cn=admin,dc=your-domain,dc=com" -W -d 1

The debug logs will highlight specific failures (e.g., cert trust issues, protocol mismatches).

内容的提问来源于stack exchange，提问作者Paulo Ricardo Bruck