Leopard LDAP SSL Problem

We have recently implemented Openldap on a Linux server. We tested it on a client system running Leopard (10.5.6) with Apple Mail early in the process and it worked well and retrieved test data quite nicely (better implementation than Outlook or Thunderbird). Then we turned on SSL encryption using a valid cert (& chain) from GoDaddy. This now works successfully with Thunderbird, Outlook, Evolution, Horde, and ldapsearch on the command line in Fedora.

However, it does not work with Apple Mail, nor the Apple Address Book. Nor does it work with ldapsearch in the Mac terminal. In each case it has an authentication problem attempting to connect. On the server, the logs indicate that “slapd[13422]: conn=3392 fd=22 closed (TLS negotiation failure)” Interestingly, it does work with Thunderbird on the Mac.

We have googled the problem extensively and discovered the Leopard issue with TLS_REQCERT=demand. Unfortunately, changing it to “allow” does not fix the problem; “never” is not an option because our server requires security. Adding the cert as a TLS_CACERT also does not fix the problem.

It surprised me that the Mac has openldap installed by default. It doesn’t seem to be running slapd when I do a /sbin/service –list. After poking around, I’m not clear whether it is actually running an LDAP directory behind the scenes and using that to mirror or cache in some way LDAP requests from the GUI, or whether it is actually just using the client utilities such as ldapsearch to go against whatever server you tell it to use.

Do you know of any solutions to this issue? We do not see manually installing the cert on each Mac client as a solution (and it didn’t work when we tried it, anyways). Thanks for your help.

AT