Yesterday I had to restart my Mac OS X Lion Server and after reboot I observed that I do not have any connection to my LDAPv3 on the localhost as well as no users available in Server application.
Next, Server application has showed three outdated certificates. Their names starting with "APNS".
I am not sure whether the issue is connected to those certificates specifically, but unfortunately "slapd" refers to issues with main certificates for my internal domain.
Following is the log from slapd itself:
Oct 27 17:49:57 apple slapd: @(#) $OpenLDAP: slapd 2.4.23 (Jun 24 2012 23:35:56) $ email@example.com:/private/var/tmp/OpenLDAP/OpenLDAP-186.5~1/servers/slapd Oct 27 17:49:57 apple slapd: daemon: SLAP_SOCK_INIT: dtblsize=8192 Oct 27 17:49:57 apple slapd: main: TLS init def ctx failed: -1 Oct 27 17:49:57 apple slapd: slapd stopped.
System log obviously shows:
Oct 27 17:53:19 apple com.apple.launchd (org.openldap.slapd): Exited with code: 1 Oct 27 17:53:19 apple com.apple.launchd (org.openldap.slapd): Throttling respawn: Will start in 10 seconds
While trying to start slapd from command line (using:
/usr/libexec/slapd -d -1), I receive the following message before crash:
TLS: attempting to read `/etc/certificates/domain.com.456DACFFC771F8EB2F5A8E0EBB269969B8164097.key.pem'. execv failed TLS: could not use key file `/etc/certificates/domain.com.456DACFFC771F8EB2F5A8E0EBB269969B8164097.key.pem'. LS: error:0D07207B:asn1 encoding routines:ASN1_get_object:header too long /SourceCache/OpenSSL098/OpenSSL098-49/src/crypto/asn1/asn1_lib.c:150 main: TLS init def ctx failed: -1 slapd destroy: freeing system resources. slapd stopped.
If I remove TLS configurations options from "/etc/openldap/slapd_macosxserver.conf" then I am able to start the daemon (using:
/usr/libexec/slapd -d -1 -f slapd_macosxserver.conf. All my users a back, I can log-in via Workgroup Manager or Server application.
Meanwhile the Server Admin in the Open Directory entry shows that:
- LDAP Server is: Running
- Password Server is: Stopped
- Kerberos is: Running
I have tried couple of things, but still have no idea how to fix the problem.