php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #73558 LDAP_OPT_X_TLS_CACERTFILE silently ignored
Submitted: 2016-11-17 21:23 UTC Modified: 2021-07-27 06:54 UTC
Votes:11
Avg. Score:4.6 ± 0.5
Reproduced:10 of 10 (100.0%)
Same Version:3 (30.0%)
Same OS:5 (50.0%)
From: jmaguire at duo dot com Assigned: heiglandreas (profile)
Status: Re-Opened Package: LDAP related
PHP Version: 7.1.0RC6 OS: Linux
Private report: No CVE-ID: None
View Developer Edit
 [2016-11-17 21:23 UTC] jmaguire at duo dot com 
Description:
------------
New in PHP 7.1, LDAP_OPT_X_TLS_CACERTFILE should allow you to specify a CA certificate for an LDAP connection. However, this setting is silently ignored in lieu of the global system LDAP settings.

Test script:
---------------
<?php

$conn = ldap_connect("ldaps://svr-dc01.acme.local", 389);
var_dump($conn);
ldap_set_option(LDAP_OPT_X_TLS_CACERTFILE, '/var/www/html/cert/ldap/acme_ad.crt');
ldap_start_tls($conn);
$ldap_bind = ldap_bind($conn, 'acme\\administrator', 'password');
var_dump($ldap_bind);

// root@7a4887b9f003:~# php ldap.php
// resource(4) of type (ldap link)
// bool(false)

// root@7a4887b9f003:~# cp /var/www/html/cert/ldap/acme_ad.crt /var/www/html/cert/ldap/active.crt
// root@7a4887b9f003:~# php ldap.php
// resource(4) of type (ldap link)
// bool(true)
//
// root@7a4887b9f003:~# cat /etc/ldap/ldap.conf
// TLS_CACERT /var/www/html/cert/ldap/active.crt

Expected result:
----------------
I expect to receive "bool(true)" in both results, as the LDAP certificate used should be /var/www/html/cert/ldap/acme_ad.crt.

Actual result:
--------------
I receive "bool(false)" in the first result because the LDAP certificate "/var/www/html/cert/ldap/active.crt" (set in /etc/ldap/ldap.conf) is being used instead -- as such, if the cert is copied to that path, I receive "bool(true)"

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2016-11-18 10:42 UTC] cmb@php.net
-Status: Open +Status: Feedback -Assigned To: +Assigned To: cmb
 [2016-11-18 10:42 UTC] cmb@php.net 
Form looking at the sources[1], LDAP_OPT_X_TLS_CACERTFILE is only
supported for LDAP_API_VERSION > 2000.

Which API version does phpinfo() report for you?

[1] <https://github.com/php/php-src/blob/php-7.1.0RC6/ext/ldap/ldap.c#L2238-L2245>
 [2016-11-18 14:51 UTC] jmaguire at duo dot com
-Status: Feedback +Status: Assigned
 [2016-11-18 14:51 UTC] jmaguire at duo dot com 
root@1bee5dfaf619:/# php71 -i | grep '^ldap$' -A10
ldap

LDAP Support => enabled
RCS Version => $Id: 0f82354ac9a0aaea23809d237e9f75e99b647142 $
Total Links => 0/unlimited
API Version => 3001
Vendor Name => OpenLDAP
Vendor Version => 20442

Directive => Local Value => Master Value
ldap.max_links => Unlimited => Unlimited
 [2016-11-18 15:19 UTC] cmb@php.net
-Status: Assigned +Status: Open
 [2016-11-18 15:19 UTC] cmb@php.net 
Thanks for the quick feedback!
 [2016-11-18 15:19 UTC] cmb@php.net
-Assigned To: cmb +Assigned To:
 [2017-01-10 07:48 UTC] heiglandreas@php.net
-Status: Open +Status: Feedback
 [2017-01-10 07:48 UTC] heiglandreas@php.net 
There seems to be an issue with that setting in the underlying OpenLDAP-library that ignores LDAP_OPT_X_TLS_CACERTFILE when LDAP_OPT_X_TLS_CACERTDIR is not set[1].

Could you check whether setting that second option makes a difference?

[1] http://www.openldap.org/lists/openldap-software/200401/msg00777.html
 [2017-01-10 07:48 UTC] heiglandreas@php.net
-Assigned To: +Assigned To: heiglandreas
 [2017-01-22 04:22 UTC] php-bugs at lists dot php dot net 
No feedback was provided. The bug is being suspended because
we assume that you are no longer experiencing the problem.
If this is not the case and you are able to provide the
information that was requested earlier, please do so and
change the status of the bug back to "Re-Opened". Thank you.
 [2018-12-03 10:54 UTC] mail at ckristo dot net 
Hi,

We have an internal CA which we need to add in order to establish a LDAPS connetion successfully. On our setup, we encounter the same issue, it seems that `ldap_set_option($ldap, LDAP_OPT_X_TLS_CACERTFILE, '<val>')` and `ldap_set_option($ldap, LDAP_OPT_X_TLS_CACERTDIR, '<val>')` are completely ignored. When setting the same paths via .ldaprc, PHP LDAP works fine.

Best regards,
Chris
 [2019-01-15 21:20 UTC] theodorejb at outlook dot com 
I'm also having this issue on Windows with PHP 7.3.0.
 [2019-08-27 19:05 UTC] jimp at netgate dot com 
I've been experimenting with this and it doesn't appear to have any effect on PHP 7.3 running under PHP-FPM on FreeBSD (11.x or 12.x), and OpenSSL 1.0 or 1.1.1 didn't make a difference either.

I can only make a successful LDAP connection with a self-signed CA when using putenv() to set LDAPTLS_REQCERT/LDAPTLS_CACERTDIR/LDAPTLS_CACERT. If I try using ldap_set_option(), the only result is failure with a packet capture showing an "unknown CA" error being sent back to the server.

I was using it this way:

ldap_set_option($ldap, LDAP_OPT_X_TLS_REQUIRE_CERT, LDAP_OPT_X_TLS_HARD);
ldap_set_option($ldap, LDAP_OPT_X_TLS_CACERTDIR, "/var/certs/");
ldap_set_option($ldap, LDAP_OPT_X_TLS_CACERTFILE, "/var/certs/blah.ca");
 [2021-07-26 13:26 UTC] cmb@php.net
-Status: No Feedback +Status: Re-Opened
 [2021-07-26 13:26 UTC] cmb@php.net 
Re-opening, since this appears to still be unresolved.  Apparently
related to bug #78029.
 [2021-07-27 06:54 UTC] heiglandreas@php.net 
Which LDAP-API Version are we talking about here? 

You can find that via `php -i | grep -i "LDAP Support" -A 5` 

As some of the functionality is not available with older API-Versions.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Fri Oct 31 19:00:02 2025 UTC