LDAPS fails to connect.

After updating the certificate cipher from SHA1 to SHA2 LDAPS fails to connect.

We have a ejabberd 2.1.1 installed on Ubuntu 14.04, we authenticate our users against the Windows Active Directory with ldaps. It worked before we've updated the certificates cipher.

I tried to fix this issue before by upgrading the OS from Ubuntu 12.04 to Ubuntu 14.04.
After the Upgrade ejabberd does not crash, what it did with Ubuntu 12.04, but connection through ldaps still fails.
I've successfully connected and authenticated with "ldapsearch" from the same server to the same AD.

But with ejabberd I have the following error messages with debug level "info".


=ERROR REPORT==== 25-Sep-2015::10:46:09 ===
E(<0.523.0>:eldap_pool:81) : LDAP request failed: timed out

=INFO REPORT==== 25-Sep-2015::10:46:09 ===
I(<0.523.0>:ejabberd_c2s:649) : ({socket_state,tls,{tlssock,#Port<0.2825>,#Port<0.2827>},<0.522.0>}) Failed authentication for user@jabber.example.net

=INFO REPORT==== 25-Sep-2015::10:46:09 ===
D(<0.523.0>:ejabberd_c2s:1553) : Send XML on stream = <<"">>

=INFO REPORT==== 25-Sep-2015::10:46:09 ===
D(<0.522.0>:ejabberd_receiver:320) : Received XML on stream = ""

=INFO REPORT==== 25-Sep-2015::10:46:09 ===
D(<0.522.0>:shaper:61) : State: {maxrate,1000,991.3320713360566,
                                    1443170659394196}, Size=16
M=15.862504938759384, I=110461.448


=INFO REPORT==== 25-Sep-2015::10:46:09 ===
D(<0.523.0>:ejabberd_c2s:1553) : Send XML on stream = ""

=INFO REPORT==== 25-Sep-2015::10:46:09 ===
D(<0.523.0>:ejabberd_socket:178) : Error in tls:send: {'EXIT',
                                                       {badarg,
                                                        [{erlang,
                                                          port_control,
                                                          [#Port<0.2827>,4,
                                                           ""],
                                                          []},
                                                         {tls,send,2,
                                                          [{file,"tls.erl"},
                                                           {line,216}]},
                                                         {ejabberd_socket,
                                                          send,2,
                                                          [{file,
                                                            "ejabberd_socket.erl"},
                                                           {line,171}]},
                                                         {ejabberd_c2s,
                                                          wait_for_feature_request,
                                                          2,
                                                          [{file,
                                                            "ejabberd_c2s.erl"},
                                                           {line,740}]},
                                                         {p1_fsm,handle_msg,
                                                          10,
                                                          [{file,"p1_fsm.erl"},
                                                           {line,544}]},
                                                         {proc_lib,
                                                          init_p_do_apply,3,
                                                          [{file,
                                                            "proc_lib.erl"},
                                                           {line,239}]}]}}

=INFO REPORT==== 25-Sep-2015::10:46:10 ===
D(<0.500.0>:ejabberd_receiver:320) : Received XML on stream = ""

=INFO REPORT==== 25-Sep-2015::10:46:10 ===
D(<0.500.0>:shaper:61) : State: {maxrate,1000,2.163959176382282,
                                    1443170740100935}, Size=65
M=32.53520242492144, I=30021.366


=INFO REPORT==== 25-Sep-2015::10:46:10 ===
D(<0.501.0>:ejabberd_c2s:1553) : Send XML on stream = <<"">>

=INFO REPORT==== 25-Sep-2015::10:46:19 ===
D(<0.515.0>:ejabberd_receiver:320) : Received XML on stream = ""

=INFO REPORT==== 25-Sep-2015::10:46:19 ===
D(<0.515.0>:shaper:61) : State: {maxrate,1000,2.162460223951461,
                                    1443170749567214}, Size=65
M=32.53517801416741, I=30029.12

=ERROR REPORT==== 25-Sep-2015::10:48:33 ===
E(<0.296.0>:eldap:1009) : LDAP connection failed:
** Server: example.contoso.net:636
** Reason: etimedout
** Socket options: [{packet,asn1},{active,true},{keepalive,true},binary]

=ERROR REPORT==== 25-Sep-2015::10:48:33 ===
E(<0.282.0>:eldap:1009) : LDAP connection failed:
** Server: example.contoso.net:636
** Reason: etimedout
** Socket options: [{packet,asn1},{active,true},{keepalive,true},binary]

=ERROR REPORT==== 25-Sep-2015::10:48:33 ===
E(<0.293.0>:eldap:1009) : LDAP connection failed:
** Server: example.contoso.net:636
** Reason: etimedout
** Socket options: [{packet,asn1},{active,true},{keepalive,true},binary]

=ERROR REPORT==== 25-Sep-2015::10:48:33 ===
E(<0.291.0>:eldap:1009) : LDAP connection failed:
** Server: example.contoso.net:636
** Reason: etimedout
** Socket options: [{packet,asn1},{active,true},{keepalive,true},binary]

=INFO REPORT==== 25-Sep-2015::10:48:34 ===
I(<0.296.0>:eldap:976) : LDAP connection on example.contoso.net:636

=INFO REPORT==== 25-Sep-2015::10:48:34 ===
I(<0.282.0>:eldap:976) : LDAP connection on example.contoso.net:636

=INFO REPORT==== 25-Sep-2015::10:48:34 ===
I(<0.293.0>:eldap:976) : LDAP connection on example.contoso.net:636

=INFO REPORT==== 25-Sep-2015::10:48:34 ===
I(<0.291.0>:eldap:976) : LDAP connection on example.contoso.net:636

I've also tryed to set tls_verify to false for testing, which gave me the same result.
Naming the full path to the certificate which worked with "ldapsearch" has given the same result either.

Does anybody have ejabberd with ldaps and sha2 certificate?
Iam not completely shure that the error occurs for that reason.

Hi, I have got the same

Hi,
I have got the same problem.

Do you find some solution?

Syndicate content