There are certain properties in your LDAP configuration found in the chef-server.rb file (Chef Infra Server) that will need to be changed to let the system know you want a secure connection, which port to use for the secure connection, and where it can find the certificate chain authorizing this secure connection. If you wish to test using a command such as ldapsearch, you will also want to modify the TLS certificate location found within your /etc/openldap/ldap.conf file, and point it to your TLS certificate chain that Chef Infra Server uses for LDAP.

Switching from nonsecure LDAP to secure without making any changes to your chef-server.rb configuration file and necessary certificates.

To ensure your system properly utilizes your secure TLS connection for LDAP SSO, you will need to place the entire certificate chain (or at least the CA certificate AND the intermediate or leaf certificate) into a .pem formatted file and place it into your /ops/opscode/embedded/ssl/certs folder for Chef Infra Server to pick it up.

Additionally, the Chef Infra Server needs to have several properties changed or confirmed in its chef-server.rb file as looking like this:

# Point to new secure ldap server
ldap['host'] = 'new-ldap-host.com'  

# Use new secure port
ldap['port'] = 636 

# Set correct certificate type, ensuring to avoid apostrophes or quotes around boolean 
ldap['ssl_enabled'] = false
ldap['tls_enabled'] = true

A couple of quick and easy tests to perform that you can utilize to confirm your configuration is correct are found below. These will test your connection to your LDAP server, with Chef removed from the equation.

This first example will test your LDAP host connection with a simple search using the ldapsearch command. For this to properly work, you will want to point to the same certificate chain that Chef is using by placing the TLC_CACERT property into the ldap.conf file, and point to where the certificate file is located.

An example might look like this for an ldap.conf file located at /etc/openldap/ldap.conf:

TLS_CACERT /opt/opscode/embedded/ssl/certs/ldaps.pem

And an example of the ldapsearch command for testing:

ldapsearch -LLL -H ldaps://new-ldap-host.com:636 -b 'BASE_DN' -D 'BIND_DN' -W '(LOGIN_ATTRIBUTE=YOUR_LDAP_ACCOUNT_USERNAME)'

A second test is to verify that you have the correct certificate chain to authenticate securely with your host:

openssl s_client -connect new-ldap-host.com:636 -CAfile cacert.pem