LDAP Service quits with error “main: TLS init def ctx failed: -1”

[macjonte]

Mood: Too many to choose from, left indifferent. =)
To start with: This issue is already solved. It took me eight hours to figure out what was wrong and repair it. Maybe its long, but I want to save your time in case you do the same as I did.

Symptom: LDAP Service in Open Directory is stopped. No user can login to any service. Can not even list the contents of the directory with Workgroup Manager without a weird error. In the LDAP log of Server Admin it says every 10 seconds:
slapd[1632]: @(#) $OpenLDAP: slapd 2.4.11 (Aug 12 2010 17:17:10) $
slapd[1632]: daemon: SLAP_SOCK_INIT: dtblsize=8192
slapd[1632]: main: TLS init def ctx failed: -1
slapd[1632]: slapd stopped.
slapd[1632]: connections_destroy: nothing to destroy.

Ok, this is what I had to start working with. 10 minutes to get this far. What would you do in this case?

Broken LDAP database I think. Google answers to restore LDAP database from Time Machine Backup. tons of pages, among this,

Recovering A Corrupt OpenLDAP Database On OSX Server

http://forums.macrumors.com/showthread.php?t=878356
People are arguing whenever TimeMachine actual make backups of Open Directory database or not. Better backup with carbon copy cloner, blablabla.

Google about repairing Open Directory database. Finds a good command line:
sudo db_recover -cev -h /var/db/openldap/openldap-data/

Also finds a command line for verifying if the ldap database is health.
sudo /usr/libexec/slapd -Tt
It turns out, it’s verified without problem. So a damaged database is not the issue. (I should of course had run this from the start)

Finds out that in 10.6 TimeMachine IS doing backup of the database, it is stored within a hidden folder on the root volume called “.ServerBackups” along with other things people are arguing about.

Made first an archive with Server Admin of the current not working setup. Copy the backup of the database to the servers desktop, using Server Admin to restore. Same problem. Select a month old backup image, same problem.

It can’t be the LDAP service at all, since a known good working database is in place, and its still the same problem.
5 hours. (And 2h sleep :). LDAP has never been my good side. Tired and technical google searches…

What else have changed during the last days? I have installed a new security certificate. Before there was no problem running on a self signed certificate since all the clients had this installed anyway. But around a week ago, I installed a CA signed certificate. Could it be something with this, and I know for a fact that this have worked with the new certificate installed and the old self signed removed, why is the problem coming now?

Its the first restart since removing the old certificate. (nightly scheduled restart). OK, we need to get the old self signed certificate in place again.

Finds the certificates in /private/etc/certificates – nothing happened when I took the old certificates and put it in place. (maybe a restart here would change this fact though)
OK, need to import them with server admin. Drag the private certificate here, ***.key.pem – password required, and the administrator password does not work.

Eating, needs energy.

Google. It turns out that when generating private certificates the computer randomizes the password for encrypting the private key of the certificate. Use keychain to retrieve the password or export the private key. Can’t find it there, maybe because I already deleted the certificate. Here, I might read an older backup of the keychain in a empty computer, but I didn’t. I maybe could have launched the keychain access as root with hope of better export options, but I remember I already did that earlier. Yes, found the exported private key with a password that I know. Imports.

Now it says LDAP service is running, but still no one can login. Restoring todays archive of Open Directory. Same. Restarting computer. Everything works as nothing happened.

OH-MY-GOD.
Ok visdoms from this:
– Its strange that there is so little info about this particular problem on the net, I can not be the only one deleting a self signed certificate. Write down everything to others to read.
– make sure all databases has some kind of automatic daily dumping. No backup utility is better than the database it self to create a backup of it.
– Time Machine works as a backup for 10.6 server. With a combo with crashplan for the information offsite everything is covered.
– Make documentation how to restore. What information could be interesting to restore? eg, user files, content of wiki server, dovecot mail, open directory database, certificates, web pages, MySQL database etc. Write down how to restore every single one of this. Be extremely clear, like you are trying to get someone on a internet forum to be able to do it. (you don’t know if you will be there the day it has to be restored, and you don’t know that you will remember everything you have in your brain right now). Be sure to write where to find, how to do, and write down the terminal commands if those are needed.

Even if you are having a good day the day you are there live and is in a hurry to restore, to have everything documented with step by step is saving you a lot of time.

Hope someone was helped by this!
now off to bed, new working day in 2 hours…

[Author]

Posts