Server crash on CRL retrieval using LDAP

HCL Domino Domino Forum
1

Dear all,

I´m checking out the S/MIME functionalities of Notes/Domino 6.

One test checked the verification of an S/MIME signed message by a

non-Notes mail client using certificates issued by the Domino PKI.

This mail client tried to retrieve the CRL using LDAP from the Notes

Directory during the certificate path verification. As a result, the

whole Domino server (not just the LDAP service) crashed due to the LDAP query.

In the Fix List Database of version 6.0.1 a related issue (SPR# YGUO5E7MW4 -

Fixed a crash in the LDAP server when doing a compare operation on a non-asci

value) was claimed to be fixed in version 6.0.1. Thus I upgraded the Domino

Server from 6.0 to 6.0.1. However, the server still crashed on LDAP queries as before.

This issue is a security threat, as - depending on the configuration - the

crash might be (intentionally) caused by bogus insiders or, even worse,

outsiders (In order to exchange secure email with S/MIME, externals should

be able to access the directory via LDAP as well). Also, the LDAP server runs

by default and thus may run even if there is no need for it.

Is there anybody who had similar experiences ? Is there a way to overcome

these problems, e.g., by configuring the LDAP server suitably ?

Otherwise, I recommend to quit the LDAP service in 6.0 and 6.0.1.

Thank you for your comments in advance,

Markus Michel

2

Subject: Server crash on CRL retrieval using LDAP

It’s difficult to say if the crash is the same as the one which was fixed in 6.01 (YGUO5E7MW4). If the client is retrieving the CRL it will typically submit an LDAP search request not a compare request (the fix addressed a crash specifically in compare request processing), so I have a feeling it’s not the same.

I would suggest you work through Lotus Support to resolve this problem. They’ll need, at a minimum, the RIP file from the crash. A reproducible scenario would be ideal.

Hope this helps,

-smd

3

Subject: Server crash on CRL retrieval using LDAP

Hi i’m trying to use domino’s CRL with LDAP too, but i can’t make the LDAP to work properly.

I’m trying to check certificates but i cant make the CRL to work.

My question is, the CRL works with the distribution point and LDAP? works without LDAP via http?

Thanks