title: Postgresql LDAP authentication over SSL
body: <p>How do I set up postgresql 9.1 on Ubuntu server 12.04 to use LDAP authentication over SSL against a Windows AD server.</p>
  
  <p>Client SSL is set up and works in postgresql.</p>
  
  <p>LDAP without SSL works.</p>
  
  <p>In pg_hba.conf I have this:</p>
  
  <pre><code>hostssl  ldaptest all   0.0.0.0/0 ldap ldapserver="myldapserver.local" ldapprefix="cn=" ldapsuffix=", ou=TestOU, dc=sub, dc=example, dc=local"
  </code></pre>
  
  <p>I am able to connect with psql, though passwords are sent unencrypted as expected.</p>
  
  <p>If I set it to use TLS on normal port (389):</p>
  
  <pre><code>hostssl  ldaptest all   0.0.0.0/0 ldap ldapserver="myldapserver.local" ldapprefix="cn=" ldapsuffix=", ou=TestOU, dc=sub, dc=example, dc=local" ldaptls=1
  </code></pre>
  
  <p>I get:</p>
  
  <pre><code>could not start LDAP TLS session: error code -11
  </code></pre>
  
  <p>If I set it to use the LDAPS port (636) to use SSL:</p>
  
  <pre><code>hostssl  ldaptest all   0.0.0.0/0 ldap ldapserver="myldapserver.local" ldapprefix="cn=" ldapsuffix=", ou=TestOU, dc=sub, dc=example, dc=local" ldaptls=0 ldapport=636
  </code></pre>
  
  <p>I get:</p>
  
  <pre><code>LDAP login failed for user "cn=Teszt User,ou=TestOU,dc=sub,dc=example,dc=local" on server "ratotdc.okologia.mta.local": error code -1
  </code></pre>
  
  <p>If I turn on both TLS and set the port to 636 I get:</p>
  
  <pre><code>could not start LDAP TLS session: error code -11
  </code></pre>
  
  <p>I have the server certificate in my ldap.conf:</p>
  
  <pre><code>TLS_CACERT      /root/certs/infolabtest_cert.cer 
  </code></pre>
  
  <p>ldapsearch works over SSL and returns correct results:</p>
  
  <pre><code>ldapsearch -W -H ldaps://myldapserver:636/ -D "CN=Teszt User,OU=TestOU,DC=sub,DC=example,DC=local" -b "ou=testou,dc=sub,dc=example,dc=local" "CN"
  </code></pre>
  
  <p>Any idea is welcome.</p>