Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We need to connect our php script to LDAP over tls using a certificate. LDAP connection works nicely without tls. More details here http://stackoverflow.com/questions/15260252/how-to-use-multiple-tls-certificates-for-ldap-from-php-zend

We managed to connect via tls from Windows using Softerra LDAP Browser. It asked us to install a certificate and whether we trust it.

My end result is to be able to authenticate with LDAP using TLS from php. I have been given a certificate of type .cer. It comes from a Windows Exchange machine. From what I can see SLES supports .pem certificates. So my question is ...

Q1: Do I need to convert from .cer to .pem first before I can install the certificate on the client (which is SLES server) and finally Q2: what is the best way to install this certificate on the server so my php application can access it and do its job. Note that on the SLES server we need to connect to different LDAP servers.

At present if we run

ldapsearch -H ldaps://localhost:9215 -W

we get

Enter LDAP Password: 
ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1)
additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed (unable to get local issuer certificate)

I found lots of good info here http://www.php.net/manual/de/function.ldap-connect.php#36156 and especially this sentence is important in my eyes Once you've gotten the ldapsearch tool working correctly PHP should work also.

  • SUSE Linux Enterprise Server 11 (x86_64)
  • ldapsearch: @(#) $OpenLDAP: ldapsearch 2.4.26 (Sep 26 2012 13:14:42) $ abuild@baur:/usr/src/packages/BUILD/openldap-2.4.26/clients/tools (LDAP library: OpenLDAP 20426)
share|improve this question
An alternate way to debug is to ignore the LDAP part and just look at the SSL: You can run "openssl s_client -connect localhost:9215" to spit out the cert the server uses and the validation results. – Kowh Mar 22 '13 at 2:06
OK. I'll pass it onto the developer. I still personally don't understand how I install certificate and it's linked to a server when I want to access it. – Radek Mar 22 '13 at 3:29

Use the LDAPTLS_REQCERT variable to ignore the certificate on the server which could be expired or invalid i.e.:

LDAPTLS_REQCERT=never ldapsearch -D "cn=drupal-test,ou=Services,dc=example,dc=com" -w my_pass -h ldap.example.com -b "ou=People,dc=example,dc=com" -s sub -x -ZZ "(uid=admin)"

or check the server if it has the right certificate.

share|improve this answer

I'm not sure about the conversion from pem to cer, but to make ldapsearch use certs w/o having a ldap.conf or w/o the permissions to modify global certs you should be able to do this:

env LDAPTLS_CACERT=/path/to/cert ldapsearch
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.