Fedora Core 11 LDAP connectivity problesm

[lilott8]

So one day we wake up and there is no ldap connectivity from our webserver to our LDAP server. It works one day, then nothing the next.

I have done several (thousand) ds traces to see if I can pin point the problem. Here are the results from several of the DS traces:

Using port 636 no TLS:

6124D1A0 FFFFFFFF -1 LDAP: Rejecting unencrypted bind on cleartext port in nds_back_bind, err = 13

Using port 389 not TLS:

7E7C5480 FFFFFFFF -1 LDAP: Rejecting unencrypted bind on cleartext port in nds_back_bind, err = 13
7E7C5480 FFFFFFFF -1 LDAP: Rejecting unencrypted bind on cleartext port in nds_back_bind, err = 13

Using port 636 WITH TLS forced for all operations:

7E7C5480 FFFFFFFF -1 LDAP: TLS accept failure 1 on connection 0x96a202a0, setting err = -5875. Error stack:
   error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca - SSL alert number 48
7E7C5480 FFFFFFFF -1 LDAP: TLS handshake failed on connection 0x96a202a0, err = -5875
7E7C5480 FFFFFFFF -1 LDAP: BIO ctrl called with unknown cmd 7

Using port 389 WITH TLS forced for all operations:

7E20A1E0 000080E6 105 Auth: 1 GlobalGetSEV.
7E20A1E0 000080E6 105 Auth: 4 GlobalGetSEV succeeded.
7E7C5480 FFFFFFFF -1 LDAP: TLS accept failure 1 on connection 0x96a202a0, setting err = -5875. Error stack:
   error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca - SSL alert number 48
7E7C5480 FFFFFFFF -1 LDAP: TLS handshake failed on connection 0x96a202a0, err = -5875
7E7C5480 FFFFFFFF -1 LDAP: BIO ctrl called with unknown cmd 7

Our eDirectory server is running Novell Netware 5.70.06[DS].
We are running eDirectory version 8.7.x

We have read something somewhere that had mentioned it being a certificate problem; we have verified that no certificate has expired and all are valid. Any information would prove incredibly useful.

Each time we try to authenticate, the webserver, for obvious reasons, throws a "ldap_bind() error". I have created a self signed certificate for our webserver, but I haven't told it to use it, as that cert only applies to connections coming into that server. We are fairly certain the problem is with eDirectory, but we have not 100% verified it. We are still searching. Thanks.