On Dec 4, 2025, at 3:45 AM, Marc Fradin <marc.fradin@imt-atlantique.fr> wrote:

I just installed : *Ubuntu *24.04.2 LTS" and *FreeRADIUS *Version 3.2.5

We use our LDAP directory for authentication using the `userpasswd` field, which is encoded in SCYPT (EAP/TTLS/PAP).

Everything works fine, but it's impossible to perform "LDAP over TLS or SSL" (start_tls = yes in module ldap )

That is an unfortunately common problem.

Here's the error message : *!! libldap is using GnuTLS, while FreeRADIUS is using OpenSSL !! There may be random issues with TLS connections due to this conflict. !! The server may also crash. *

* !! See https://wiki.freeradius.org/modules/Rlm_ldap for more information.*

How can I fix ? Should I install another library like `libldap`?

Your choices are: * don't use TLS with libldap (not really recommended) * set up a local "stunnel" connection from the FreeRADIUS machine to the machine running LDAP, and use that for the LDAP connections. * switch libldap to one which uses OpenSSL. You might be able to download it from https://ltb-project.org/download.html I don't know why so many distributions insist on using GnuTLS. It simply does not do the same things as OpenSSL. Any application which needs a full-featured TLS library cannot use GnuTLS. It's really only good for "doing TLS" without much of any policies or features. Alan DeKok.