iRedMail — Cannot connect to ldaps

Re: Cannot connect to ldaps

null@example.com (tomierna) — Mon, 01 Dec 2025 16:34:07 +0000

ZhangHuangbin wrote:

Does it work if you replace the 127.0.0.1 by server hostname?

I tried with FQDN, no change. Still says Can't contact LDAP server (-1).

ZhangHuangbin wrote:

FYI interesting article:
https://blog.oholics.net/ldapsearch-syn … and-sldap/

It appears that the -h option has been removed from ldapsearch, so I can't try the non-URI option this article shows to see if I get the same error.

Re: Cannot connect to ldaps

null@example.com (ZhangHuangbin) — Wed, 26 Nov 2025 01:04:17 +0000

FYI interesting article:
https://blog.oholics.net/ldapsearch-syn … and-sldap/

Re: Cannot connect to ldaps

null@example.com (ZhangHuangbin) — Wed, 26 Nov 2025 01:03:59 +0000

Does it work if you replace the 127.0.0.1 by server hostname?

ldapsearch ... -H ldaps://:636 ...

Re: Cannot connect to ldaps

null@example.com (tomierna) — Tue, 25 Nov 2025 15:49:42 +0000

root@mail:~# lsof -i:636
COMMAND     PID     USER   FD   TYPE     DEVICE SIZE/OFF NODE NAME
slapd   4170517 openldap   11u  IPv4 1267723477      0t0  TCP *:ldaps (LISTEN)
slapd   4170517 openldap   12u  IPv6 1267723478      0t0  TCP *:ldaps (LISTEN)

root@mail:~# systemctl stop nftables
root@mail:~# ldapsearch -v -LL -x -z5 -H ldaps://127.0.0.1:636 -D 'cn=vmail,dc=mydomain,dc=com' -w "vmailldappassword" -b 'dc=mydomain,dc=com' -s sub '(&(objectclass=mailUser)(enabledService=nextcloud))'
ldap_initialize( ldaps://127.0.0.1:636/??base )
ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)

OpenLDAP is listening on 636. With NFTables turned off, the result is the same.

Re: Cannot connect to ldaps

null@example.com (ZhangHuangbin) — Mon, 24 Nov 2025 08:13:32 +0000

- Is openldap service listening on port 636?
- Try to turn off firewall service (nftables) temporarily and try again.

Re: Cannot connect to ldaps

null@example.com (tomierna) — Fri, 14 Nov 2025 19:44:44 +0000

ZhangHuangbin wrote:

Did you toggle on the option "Enable LDAP over TLS (port 389) and SSL (636)" in `Server Settings` -> `LDAP Service`?

Yes, this was already on.

Re: Cannot connect to ldaps

null@example.com (ZhangHuangbin) — Sun, 09 Nov 2025 01:51:03 +0000

Did you toggle on the option "Enable LDAP over TLS (port 389) and SSL (636)" in `Server Settings` -> `LDAP Service`?

Re: Cannot connect to ldaps

null@example.com (tomierna) — Fri, 07 Nov 2025 19:19:20 +0000

ZhangHuangbin wrote:

Did you try "-H ldaps://127.0.0.0:636"?

Just now, I did, with the same error resulting.

Re: Cannot connect to ldaps

null@example.com (ZhangHuangbin) — Fri, 07 Nov 2025 02:44:52 +0000

Did you try "-H ldaps://127.0.0.0:636"?

Cannot connect to ldaps

null@example.com (tomierna) — Thu, 06 Nov 2025 17:14:37 +0000

==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
- iRedMail version (check /etc/iredmail-release):
iRedMail Enterprise v1.3.1
- Deployed with iRedMail Easy or the downloadable installer?
iRedMail Enterprise
- Linux/BSD distribution name and version:
Ubuntu 24.04
- Store mail accounts in which backend (LDAP/MySQL/PGSQL):
LDAP
- Web server (Apache or Nginx):
Apache
- Manage mail accounts with iRedAdmin-Pro?
iRedmail Enterprise
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====

I have been able to integrate some other servers with the LDAP server running on my iRedMail Enterprise server using unencrypted ldap.

I wish to switch to ldaps on an integration, but I keep getting an error, from either the remote or local machine running an ldapsearch.

ldapsearch -x -b "dc=mydomain,dc=com" -H ldaps://127.0.0.0 -D "cn=vmail,dc=mydomain,dc=com" -W "(&(objectclass=mailUser)(enabledService=nextcloud))"
ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)

I have a valid certificate in slapd.conf.

I have ldaps:/// in the SLAPD_SERVICES line of /etc/default/slapd.

TCP ports 389 and 636 are open in the machine firewall.

lsof -i:636 shows that slapd is listening to port 636.

Any other troubleshooting steps I might try to get the iRedMail LDAP server to allow connections via ldaps://?