Consider the following:

# /usr/lib/nagios/plugins/check_ldaps -H ldap -b dc=example,dc=org
Could not init startTLS at port 389!

It is actually trying to do STARTTLS on port 389 - that is not the same
as ldaps

The name "check_ldaps" implies ldaps://

ldaps is not STARTTLS,

- ldaps is an SSL encrypted session from the beginning (STARTTLS implies
enabled encryption after some initial LDAP handshaking)

- it should default to port 636

Manually forcing it like this makes it work (also see bug 730470 which
requires a workaround to really make this work):

/usr/lib/nagios/plugins/check_ldaps -H ldap -b dc=example,dc=org -p 636 -3

tags 730471 + wontfix
thanks

Dear Daniel,

thanks for taking time to report this issue.

Am 25.11.13 12:24, schrieb Daniel Pocock:

This is all true, but the problem is, changing it to the correct
behavior will break all the existing configurations, even if they are
worked around it (via check_ldaps).
The probable upstream fix (when breaking backward compatibility) for
this would be to remove check_ldaps completly, as check_ldap supports
all of this:

" -T [--starttls]
    use starttls mechanism introduced in protocol version 3
 -S [--ssl]
    use ldaps (ldap v2 ssl method). this also sets the default port to
636"

I guess I will adjust /etc/nagios-plugins/config/ldap.cfg to use
check_ldap instead of check_ldaps soon.

Warm wished, Jan.