Zimbra

JoshuaPrismon · #1 (**permalink**) 08-27-2007, 09:12 PM

Just tried to do a install. For whatever reason, LDAP doesn't come back up in install. I have had problems with LDAP corruption in the past, but this time I have a different problem:

Code:

Failed to start slapd.  Attempting debug start to determine error.
TLS: error:0906D06C:PEM routines:PEM_read_bio:no start line pem_lib.c:644
TLS: error:0906D06C:PEM routines:PEM_read_bio:no start line pem_lib.c:644
TLS: error:0906D06C:PEM routines:PEM_read_bio:no start line pem_lib.c:644
TLS: error:0906D06C:PEM routines:PEM_read_bio:no start line pem_lib.c:644
TLS: error:0906D06C:PEM routines:PEM_read_bio:no start line pem_lib.c:644
TLS: error:0906D06C:PEM routines:PEM_read_bio:no start line pem_lib.c:644
TLS: error:0906D06C:PEM routines:PEM_read_bio:no start line pem_lib.c:644
TLS: error:0906D06C:PEM routines:PEM_read_bio:no start line pem_lib.c:644
TLS: error:140AD009:SSL routines:SSL_CTX_use_certificate_file:PEM lib ssl_rsa.c:491
main: TLS init def ctx failed: -1

I was able to recrate the certs, but it hasn't made a difference.

JoshuaPrismon · #2 (**permalink**) 08-28-2007, 12:31 AM

My suspicion is that this is a side effect of running a 32bit kernel on a 64 bit xen instance. I will play around with this more later, but for now, I backed out this upgrade.

jholder · #3 (**permalink**) 08-29-2007, 11:30 AM

Josh, May I mark this thread as solved?
john

JoshuaPrismon · #4 (**permalink**) 08-29-2007, 03:05 PM

Quote:

Originally Posted by jholder

Josh, May I mark this thread as solved?
john

No. I have not been able to fix it yet. If any Zimbra guys have any ideas, this would be great.

quanah · #5 (**permalink**) 08-29-2007, 03:14 PM

What are the contents of
/opt/zimbra/ca
?

dijichi2 · #6 (**permalink**) 08-30-2007, 03:32 AM

I used to see this lots on debian. The quick non-fix is to comment out the TLS lines in slapd.conf.in, at least that gets you started.

quanah · #7 (**permalink**) 08-30-2007, 09:56 AM

Given that 5.0 will rely heavily on TLS support, simply removing the certs definitions will not work. 5.0 beta 3 in fact relies on being able to negotiate startTLS as part of a migration script if you already have ZCS installed.

JoshuaPrismon · #8 (**permalink**) 08-30-2007, 01:00 PM

That's the weird thing. The certificate appears to be there and be valid (from a eyeball check).

Strike that. I ran the exact location, and there is no CA directory. Does anyone have a /opt/zimbra/ca?