Address Book - self signed LDAPS certifiate on openldap server

Question

I'm fairly new to the Mac, but I'm not new to FreeBSD or *NIX type boxes.
I'm trying to get Address Book to contact my openldap server that runs on OpenBSD. I have it working well with thunderbird, horde + (l)imp, dovecot, and various other openldap client based pieces of software. I use a self signed certificate on the server as most do. The key with the openldap client libraries normally is changing /etc/openldap/ldap.conf to not require a valid certificate from the server with the following setting:
TLS_REQCERT never
This setting is present in my version of OS X by default. On other *NIX machines i've had to set that manually.
If there is any chrooting involved by the client, clearly another copy of /etc/openldap/ldap.conf is necessary in the chrooted area. Does anyone know if Address Book chroots itself? Or why it isn't paying attention to the /etc/openldap/ldap.conf? I get a clear message on the server that the client is rejecting the self signed certificate.
Thanks much for your time,
Geff
Mac Book   Mac OS X (10.4.8)  

Answer 1

Where's the button for "Yes, I answered my own question." ???? Okay ... <rant on> I guess Apple is no different from everything else: openbsd, linux, windows, open source, closed source, etc. always answering our own questions. I feel like the software isn't even tested. A FIX or some more information would be nice. </rant off>
Okay here's the deal. I don't have a cert signed by an approved CA so I'm not sure if one would have to jump through fewer hoops to get it to work with a "proper" (non-self signed) cert. Turns out if you are using AddressBook to attempt to go to an LDAP server and you want SSL with a self signed cert, it seems that AddressBook won't properly attach to the LDAP server on port 636. Even tho that's what happens to the PORT setting when you CLICK THE BUTTON (bitter, am I ranting again? ). So what you do is click the button for "SSL" and then REVERT THE PORT back MANUALLY to 389. (more bitter) This causes addressbook to ... well ... uhm ... WORK. What ends up happening is that it makes a non-ssl connection initially and then upgrades the connection via "STARTTLS" to an encrypted connection. There one setting that you should have in slapd.conf (or like file) before doing this.
# Sample security restrictions
# Require integrity protection (prevent hijacking)
# Require 112-bit (3DES or better) encryption for updates
# Require 63-bit encryption for simple bind
# security ssf=1 update_ssf=112 simple_bind=64
security simple_bind=64
This requires the connection to have at least the minimum amount of encryption before the bind (authenticate) process. Keep in mind if you add this setting, anything that previously attempted to bind clear text (even on localhost) will fail. However you should never be sending a password in the clear.
Geff