Hi all, I'm trying to authenticate to a LDAPS backend but failing. Any suggestions? My freeradius version: —------------------------ radiusd: FreeRADIUS Version 2.1.1, for host i686-pc-linux-gnu, built on Nov 21 2008 at 07:54:33 My ldap module settings: —--------------------------- ldap people_search { server = "ldap1.stvincents.com.au" port = 636 identity = "cn=admin,o=org,c=au" password = *** filter = "(cn=%u)" basedn = "ou=people,ou=darlinghurst,ou=nsw,o=schs,c=au" tls { tls_mode = yes # to the LDAP database by using the StartTLS extended # operation. # # The StartTLS operation is supposed to be # used with normal ldap connections instead of # using ldaps (port 689) connections start_tls = yes cacertfile = /etc/openssl/certs/SVMHS_CA_SSL_Server.cer <note: chained CA cert> cacertdir = /etc/openssl/certs/ #certfile = /etc/openssl/certs/spud-jr.cer # keyfile = /path/to/radius.key # randfile = /path/to/rnd # Certificate Verification requirements. Can be: # "never" (don't even bother trying) # "allow" (try, but don't fail if the cerificate # can't be verified) # "demand" (fail if the certificate doesn't verify.) # # The default is "allow" require_cert = "allow" } -X output messages: —--------------------- [people_search] performing user authorization for pparam [people_search] expand: (cn=%u) -> (cn=pparam) [people_search] expand: ou=people,ou=darlinghurst,ou=nsw,o=schs,c=au -> ou=people,ou=darlinghurst,ou=nsw,o=schs,c=au rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap1.stvincents.com.au:636, authentication 0 rlm_ldap: setting TLS mode to 1 rlm_ldap: could not set LDAP_OPT_X_TLS option Success rlm_ldap: setting TLS CACert File to /etc/openssl/certs/SVMHS_CA_SSL_Server.cer rlm_ldap: could not set LDAP_OPT_X_TLS_CACERTFILE option to /etc/openssl/certs/SVMHS_CA_SSL_Server.cer rlm_ldap: setting TLS CACert Directory to /etc/openssl/certs/ rlm_ldap: could not set LDAP_OPT_X_TLS_CACERTDIR option to /etc/openssl/certs/ rlm_ldap: starting TLS rlm_ldap: ldap_start_tls_s() rlm_ldap: could not start TLS Success rlm_ldap: (re)connection attempt failed [people_search] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[people_search] returns fail Using Post-Auth-Type Reject WARNING: Unknown value specified for Post-Auth-Type. Cannot perform requested action. Delaying reject of request 0 for 1 seconds Going to the next request ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been virus scanned and although no viruses were detected by the system, St Vincents & Mater Health Sydney accepts no liability for any consequential damage resulting from email containing any computer viruses. **********************************************************************