goauthentik / goauthentik/authentik

LDAP cant get TLS (ldaps://) to work

Open
#12,162 1 comment 0 reactions 0 assignees View on GitHub
question
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 4h
Merged PRs (30d)
634

Description

**Describe your question/**
I am new to authentik and setup LDAP. The ldap:// on port 389 works fine but secured ldaps:// doesent work. I get this error and dont't know what to do anymore.

```shell
TLS: peer cert untrusted or revoked (0x42)
TLS: can't connect: (unknown error code).
ldap_err2string
ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)
```

1. Any ideas what I can do?
2. Is it safe to use normal ldap?

**Logs**
```shell
root@PC:/mnt/c/Users/linus# ldapsearch -d 1 -x -H ldaps://192.168.178.2 -D "cn=ldapservice,ou=users,DC=ldap,DC=goauthentik,DC=io" -b 'DC=ldap,DC=goauthentik,DC=io' '(objectClass=user)' -Wcc
ldap_url_parse_ext(ldaps://192.168.178.2)
ldap_create
ldap_url_parse_ext(ldaps://192.168.178.2:636/??base)
Enter LDAP Password:
ldap_sasl_bind
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP 192.168.178.2:636
ldap_new_socket: 3
ldap_prepare_socket: 3
ldap_connect_to_host: Trying 192.168.178.2:636
ldap_pvt_connect: fd: 3 tm: -1 async: 0
attempting to connect:
connect success
TLS: peer cert untrusted or revoked (0x42)
TLS: can't connect: (unknown error code).
ldap_err2string
ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)
```

**Version and Deployment (please complete the following information):**

- authentik version: [2024.10.2](https://goauthentik.io/docs/releases/2024.10)
- Deployment: docker via unraid

Contributor guide

Open the contributing guide

Research direction

No source files or tests are named. Start with the logged ldapsearch command and the authentik LDAP/LDAPS certificate configuration; determine why the peer certificate is untrusted and whether the documented secure connection path works. Done means an actionable fix or documentation for connecting over LDAPS, including the certificate requirements.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker
Domain
authentication, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.