Re: [nssldap] Questions about start_tls

[maillists0 [at] gmail.com]

Remember that it is up
to the *client* to request that encryption using TLS. I would suggest
always using encryption for NSS and PAM clients.

I'm confused about this. In /etc/ldap.conf, I have "ssl start_tls". When I set debug to 2, I can see that the output of the server is encrypted and there are a lot of "tls_read: want/got" messages, with no complaints. The only output that isn't encrypted is from the client. I am using a self-signed certificate, so I set tls_checkpeer to "no". Is this to be expected, or is tls on the client-side silently failing?