TLS confidentiality required

[rgruyters]

When I enable ssl_check_cert with ssl_ca_file I still get the following message:

http_auth_ldap: Initial bind failed (13: Confidentiality required [TLS confidentiality required])

When I check the LDAP logs:

58eb5c49 conn=101062 fd=47 ACCEPT from IP=10.x.x.x:46488 (IP=0.0.0.0:389)
58eb5c49 conn=101062 op=0 BIND dn="cn=nginx,ou=services,dc=example,dc=local" method=128
58eb5c49 conn=101062 op=0 RESULT tag=97 err=13 text=TLS confidentiality required

I have the following configuration in my NGINX file:

ldap_server test {
  url ldap://ldap.example.local:389/DC=example,DC=local?uid?sub?(objectClass=person);
  binddn "cn=nginx,ou=services,dc=example,dc=local";
  binddn_passwd "<<removed>>";
  ssl_check_cert on;
  ssl_ca_file "/etc/nginx/ssl/ca.pem";
}

I have NGINX running in a Docker container with Alpine version 3.4 running. (because 3.5 has moved to libreSSL and doesn't work with nginx-auth-ldap)

[fvm2000]

If you're using ssl on ldap, shouldn't you be using "url ldaps://" instead of "url ldap://" ?

[rgruyters]

@fvm2000 I use TLS not SSL. LDAP+TLS is via 389.

[tchoutri]

@kvspb Hi! any news about STARTTLS support? More and more organisations are using it, and I don't want to ditch Nginx in favor of apache just because of that :/

[JoeKun]

Any news on adding StartTLS support to nginx-auth-ldap? It looks like a pretty nifty authentication module, but I just can't use it until it supports StartTLS to connect to the LDAP server.

[tchoutri]

@kvspb hi, can you, like, tell us if you're not working on this project anymore?