# OpenLDAP and TLS/SSL, ERROR  Verify return code: 19

**URL:** https://forums.suse.com/t/openldap-and-tls-ssl-error-verify-return-code-19/22152
**Category:** SLES Configure-Administer
**Created:** [February 6, 2012, 7:16am UTC](https://forums.suse.com/t/openldap-and-tls-ssl-error-verify-return-code-19/22152 "2012-02-06T07:16:02Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![System1](https://avatars.discourse-cdn.com/v4/letter/s/51bf81/32.png) [@System1](https://forums.suse.com/u/System1)
#### Post date: [February 6, 2012, 7:16am UTC](https://forums.suse.com/t/openldap-and-tls-ssl-error-verify-return-code-19/22152/1 "2012-02-06T07:16:02Z")

</div>

_This case:_ Setup OpenLDAP using TLS/SSL on SLES11 SP1

_My problem:_ When I test certificate for TLS/SSL  
Error: verify error:num=19:self signed certificate in certificate  
chain, BUT from log message (var/log/message) show: slapd[4784]:  
conn=1005 fd=15 TLS established tls\_ssf=256 ssf=256

_Note:_ Step for setup CA is success!!!

## Code:

openssl s\_client -connect myhost.mydomain.local:636 -showcerts -state

* * *

CONNECTED(00000003)  
SSL\_connect:before/connect initialization  
SSL\_connect:SSLv2/v3 write client hello A  
SSL\_connect:SSLv3 read server hello A  
depth=1 /C=TH/ST=BangNOC/L=Service  
Center/O=NOC/OU=IT/CN=myhost.mydomain.local/emailAddress=ca@mydomain.com

verify error:num=19:self signed certificate in certificate chain

## verify return:0 SSL\_connect:SSLv3 read server certificate A SSL\_connect:SSLv3 read server done A SSL\_connect:SSLv3 write client key exchange A SSL\_connect:SSLv3 write change cipher spec A SSL\_connect:SSLv3 write finished A SSL\_connect:SSLv3 flush data SSL\_connect:SSLv3 read finished A

## Certificate chain

New, TLSv1/SSLv3, Cipher is AES256-SHA  
Server public key is 2048 bit  
Secure Renegotiation IS supported  
Compression: NONE  
Expansion: NONE  
SSL-Session:  
Protocol : TLSv1  
Cipher : AES256-SHA  
Session-ID:  
7ABA0C0831441B98BCE9097F0F0F913D1B6A67ABE8FBB167D14855CA2310611E  
Session-ID-ctx:  
Master-Key:  
79C3CF579194D623CC80C5141DB3B8215E6DF384F25E060848A6E7BABB15A433CBE205C67142670EC4CAD08BA6B3B786  
Key-Arg : None  
Start Time: 1328371622  
Timeout : 300 (sec)

Verify return code: 19 (self signed certificate in certificate  
chain)

* * *

One question this is encrypted TLS communication work or not?

Thank you,

## – sled1983

sled1983’s Profile: [http://forums.novell.com/member.php?userid=123367](http://forums.novell.com/member.php?userid=123367)  
View this thread: [http://forums.novell.com/showthread.php?t=451847](http://forums.novell.com/showthread.php?t=451847)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/flex022/uploads/suse/original/2X/5/5012ba89e3ffb5220dac47d5ea0ba032e2fe1cb6.png) [@system](https://forums.suse.com/u/system)
#### Post date: [February 6, 2012, 11:56am UTC](https://forums.suse.com/t/openldap-and-tls-ssl-error-verify-return-code-19/22152/2 "2012-02-06T11:56:02Z")

</div>

My question and answer, Good TLS communication is secured. But SSL  
certificate doesn’t have any particular reason to trust Verisign’s root  
CA certificate.

## Code:

openssl s\_client -connect ldap://pdcmaster.mydomain.local -showcerts -CApath /etc/ssl/certs

* * *

…  
Verify return code: 0 (ok)

_success !!!_

## – sled1983

sled1983’s Profile: [http://forums.novell.com/member.php?userid=123367](http://forums.novell.com/member.php?userid=123367)  
View this thread: [http://forums.novell.com/showthread.php?t=451847](http://forums.novell.com/showthread.php?t=451847)