EDIT: Solution is below!

So... I need to pick everyone's brains.

Trying to configure #LDAP #OpenLDAP on a #RedHat #RHEL server, and any and all attempts to use #ldapsearch to test the connection fail. The error is that it's 'unable to get local issuer certificate'.

So, yeah, it's an #SSL / #TLS error.

Here's where it gets weird.

When I use the TLS_CACERT environment variable to point to the root cert, same error. When I add the root cert to /etc/pki/ca-trust/source/anchors and run update-ca-trust, same error. Even when I check that it's been extracted properly, it's there in the extracted/pem directory.

I've tried adding all the intermediate certificates to the TLS_CACERT .pem file, and to the anchors directory, same error. Double-checked the validity dates, made sure the subject and issuer lines all matched up...

Tried testing the SSL/TLS certificates with 'openssl s_client -connect' and it connects reliably. Using the -verify_depth parameter to set the number to less than the number of certificates causes a failure, increasing it shows it's validated.

I can't use #curl, the version I've got is buggy for ldaps:// connections.

Any insight would be greatly appreciated before I lose my mind... :)

So, it turns out that OpenLDAP environment variables are prefixed with “LDAP” so it’s LDAPTLS_CACERT and LDAPTLS_REQCERT that modifies the behaviour, not the config parameters. This feels like bad form.