Dear Maintainer,

setting up a replication agreement between two LDAP servers via TLS
port 636 based on server certificates and password-based SIMPLE
authentication works without problems. The replication setup was
configured using the cockpit-389-ds web interface.

When switching to SSSLCLIENTAUTH the TLS connection fails with the
following entries in /var/log/dirsrv/slapd-localhost/errors:

- ERR - setup_ol_tls_conn - failed: unable to create new TLS context - -1
- ERR - slapi_ldap_bind - Error: could not configure the server for cert auth - error -1 - make sure the server is correctly configured for SSL/TLS
- ERR - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=ldap2-to-ldap1-agreement" (ldap1:636) - Replication bind with EXTERNAL auth failed: LDAP error 0 (Success) ()

The source code of the setup_ol_tls_conn(LDAP *ld, int clientauth) function in

https://github.com/389ds/389-ds-base/blob/389-ds-base-2.3.1/ldap/servers/slapd/ldaputil.c#L503

shows a failure to create the TLS client context in line 589:

     /* have to do this last - this creates the new TLS handle and sets/copies
        all of the parameters set above into that TLS handle context - note
        that optval is zero, meaning create a context for a client */
     optval = 0;
     if ((rc = ldap_set_option(ld, LDAP_OPT_X_TLS_NEWCTX, &optval))) {
         slapi_log_err(SLAPI_LOG_ERR, "setup_ol_tls_conn",
                       "failed: unable to create new TLS context - %d\n", rc);
     }

Since on Debian platform libldap uses libgnutls for the certificate-based
client authentication instead of NSS, the extraction of the cacerts, the
private key and the server certificate from the NSS store are required
which seems to be successful:

ls -l /tmp/systemd-private-e57d3846c23c4579b3beaa4d7a0f9e1b-dirsrv\@localhost.service-QfnrpZ/tmp/slapd-localhost/
-rw-r----- 1 dirsrv dirsrv 4837 Jun 18 14:06 Self-Signed-CA.pem
-rw-r----- 1 dirsrv dirsrv  318 Jun 18 14:06 Server-Cert-Key.pem
-rw-r----- 1 dirsrv dirsrv 2061 Jun 18 14:06 Server-Cert.pem

I did quite a profound search of the Internet but I didn't find
any recent problems with ssslclientauth based authentication
(probably because very few people are using it).

The TLS context cannot be created because the Debian Bookworm libldap-2.5-0
package is built with the GnuTLS stack instead of the OpenSSL TLS stack.

I manually built and installed libldap-2.5 linked to the OpenSSL libssl and
libcrypto libraries and the TLS connection is now successfully established
based on client certificates.

It would be very helpful if the Debian project would make available an
alternative libldap-2.5-openssl package as is the case e.g. with the
libcurl4 package that comes with gnutls, nss and openssl flavors.

Best regards

Andreas