How to add trusted root for LDAP authentication

[Anynetsolution]

Hello Community

I have zabbix 6.4 running on docker.
As i want to login on zabbix with LDAP users, I have created an LDAP authentication configuration.
As host I have the server ldaps://srv01.mydom.com and port 636 is defined.

But now the CA certificate of the srv01 host is missing, so that the LDAP connection can be trusted. I get a Handshake error

How and where do I import the CARoot certificate so that the LDAP connection works in encrypted form?

[Mitchell-Zabbix]

Hi

If you're using Apache, you can check the ssl configuration for Zabbix to find out where the ca file should be placed.
This should be under ./sites-available/default-ssl.conf.

[Anynetsolution]

Hi

There is no Apache installed.

When i run docker container list I see traefik, zabbix-db, zabbix-agent, zabbix-web, grafana and grafana-prometheus as containers

[Anynetsolution]

Hello Community

Can someone help me?
When i define the ldap as follow
Host: ldaps://srv01.mydom.com
Port: 636

I get following error:


When I change the Host to
Host: ldap://srv01.mydom.com
Port: 636

then the Test is successfull.


This doesn't make sense. It seem that the Port configuration is not applied.
Our Zabbix version is a Docker version. The CA certificate is available, and if we run a wget on the corresponding ldap server in the docker bash to test the connection, it also works.

Can someone explain to me where this LDAP configuration is written? This setting which is set in the web interface must be written in a specific file. Either on the OS itself or in the docker container.

[mumische]

Looks like Zabbix ignoring port number and use ldap:// or ldaps:// part. Check here how to add CA certificate: https://www.zabbix.com/forum/zabbix-...ps-with-zabbix

I installed CA certs, but still have had issues with ldaps, so I switched to start_tls (leave port number 389, server ldap:// and check TLS in advanced configuration) and added this line in /etc/openldap/ldap.conf
TLS_REQCERT never