# Unable To Configure LDAPS

**URL:** <https://forum.ansible.com/t/unable-to-configure-ldaps/38219>\
**Category:** AWX Project\
**Tags:** awx\
**Created:** [July 12, 2023, 3:55pm UTC](https://forum.ansible.com/t/unable-to-configure-ldaps/38219 "2023-07-12T15:55:58Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![augray](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/augray/32/8164_2.png) [@augray](https://forum.ansible.com/u/augray)\
**Post date:** [July 12, 2023, 3:55pm UTC](https://forum.ansible.com/t/unable-to-configure-ldaps/38219/1 "2023-07-12T15:55:58Z")

</div>

Hello,

I am trying to configure LDAPS for authentication within AWX. I currently have LDAP working, but have been unsuccessful in configuring LDAPS. Here is what I have tried using the instructions I can find.

- I created a pem file with the certificate chain information I received from openssl.
  - _openssl s\_client -connect ldap.server:636 -showcerts_

- I copied the cert info, two certs, in the order displayed in the output from above.

_-----BEGIN CERTIFICATE-----_  
_-----END CERTIFICATE-----_  
_-----BEGIN CERTIFICATE-----_  
_-----END CERTIFICATE-----_

- I created a generic secret using the following:

- Updated my awx configuration file to reference secret.

- I have verified that the awx container has the correct cert information:

_django\_auth\_ldap Caught LDAPError while authenticating SSL routines::certificate verify failed (unable to get issuer certificate)_

Testing the cert file with the following command:

_openssl s\_client -connect ldap.server:636 -no-CAfile -CAfile /etc/openldap/certs/ldap-ca.crt_

Results:

_Verify return code: 2 (unable to get issuer certificate)_

So, I have not configured the cert information correctly, but cannot figure out what precisely the problem is. I’m hoping that someone here can help highlight where I’ve made a mistake(s).

Thank you very much.

---

<div class="post-metadata">

**Author:** ![augray](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/augray/32/8164_2.png) [@augray](https://forum.ansible.com/u/augray)\
**Post date:** [July 12, 2023, 4:01pm UTC](https://forum.ansible.com/t/unable-to-configure-ldaps/38219/2 "2023-07-12T16:01:23Z")

</div>

Should have specified that I am using AWX-Operator, running on a single node k3s cluster, hosted on Ubuntu 22.04 LTS.

---

<div class="post-metadata">

**Author:** ![AWX\_Project](https://avatars.discourse-cdn.com/v4/letter/a/eada6e/32.png) [@AWX\_Project](https://forum.ansible.com/u/AWX_Project)\
**Post date:** [July 14, 2023, 5:33pm UTC](https://forum.ansible.com/t/unable-to-configure-ldaps/38219/3 "2023-07-14T17:33:56Z")

</div>

Looks like your steps for getting the CA cert into the deployment is correct. Appears the ca cert itself may not be formatted correctly.

does running that same openssl command to test the cert give you the same error message when running outside of the container?

how are you generating this cert?

AWX Team

---

<div class="post-metadata">

**Author:** ![augray](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/augray/32/8164_2.png) [@augray](https://forum.ansible.com/u/augray)\
**Post date:** [August 1, 2023, 8:29pm UTC](https://forum.ansible.com/t/unable-to-configure-ldaps/38219/4 "2023-08-01T20:29:50Z")

</div>

Hello AWX Team.

Thank you for your response. I do get the same error message when testing the cert/pem file outside of the container. Are my steps for generating the pem file correct?

Thank you.

---

<div class="post-metadata">

**Author:** ![AWX\_Project](https://avatars.discourse-cdn.com/v4/letter/a/eada6e/32.png) [@AWX\_Project](https://forum.ansible.com/u/AWX_Project)\
**Post date:** [August 2, 2023, 6:55pm UTC](https://forum.ansible.com/t/unable-to-configure-ldaps/38219/5 "2023-08-02T18:55:32Z")

</div>

> openssl s\_client -connect ldap.server:636 -no-CAfile -CAfile /etc/openldap/certs/ldap-ca.crt

what does -no-cafile and -cafile together do?