The following were the steps I took to resolve this issue:
Reboot the server in safe mode (hold down shift key whilst restarting)
Let it idle for a while (apparently it is cleaning out caches in this mode)
Stop the existing slapd server
sudo launchctl unload /System/Library/LaunchDaemons/org.openldap.slapd.plist
Set the correct certificate GUID in the file /etc/openldap/slapd_macosxserver.conf. This can be ascertained from the contents of the /etc/certificates directory
sudo sed -e 's/oldguid/newguid/' /etc/openldap/slapd_macosxserver.conf >/tmp/conffile
sudo mv /tmp/conffile /etc/openldap/slapd_macosxserver.conf
Remove the configured TLS certificate values from the file /etc/openldap/slapd.d/cn=config.ldif
sudo vi /etc/openldap/slapd.d/cn=config.ldif
remove any lines beginning with olcTLSCertificate
Start the slapd server again
sudo launchctl load /System/Library/LaunchDaemons/org.openldap.slapd.plist
Reboot the server again into standard mode.
Then from a client computer with linux or mac osx check that you can connect via SSL and that the certificates are correct using the command
openssl s_client -connect ldap.yourdomain:636 -showcerts
If successful you will get a dump of your server certificates as well as a connection detail description:
No client certificate CA names sent
---
SSL handshake has read 5209 bytes and written 807 bytes
---
New, TLSv1/SSLv3, Cipher is AES256-SHA
Server public key is 4096 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
Protocol : TLSv1
Cipher : AES256-SHA
Session-ID: C8E0F4A4ED24021DB4D98ACF5A9ACDC2293BC3961BF2AE90026115D899369E73
Session-ID-ctx:
Master-Key:
Key-Arg : None
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket:
...
Start Time: 1400140597
Timeout : 7200 (sec)
Verify return code: 0 (ok)
Some other notes:
- Apple suggests that you can use self-signed and own certificate
chains (http://support.apple.com/kb/ht3745). I use a self signed
chain and it is successful.
- Port 636 is the standard ldaps port and is the port used by OpenDirectory (slapd)
- TLS1 is supported as can be seen from the openssl connection test
- Differing DNS names and host names do not matter (I tried both ways with a reboot between)
- Differing reverse DNS does not matter (I tried both ways with a reboot between)
SSL handshake has read 0 bytes and written 319 bytes
: this seems like it might be a firewall issue. Check that the port is open, and try disabling the firewall. You can also check which ports are open by usingnetstat -na
.