Wondering how to fix the ‘could not bind to the LDAP server’ error in Nagios? We can help you fix it.

Here at Bobcares, we have seen several such Nagios-related issues as part of our Server Management Services for web hosts and online service providers.

Today we’ll take a look at the causes for this problem and see the fix.

When and why does ‘could not bind to the LDAP server’ error occurs

Recently, we had a customer who was trying and executing the check_ldaps plugin:

/usr/local/nagios/libexec/check_ldaps -H dc01.domain.local -b ” -p 636

As a result, he received the below error message.

Could not bind to the LDAP server

Also, he tried to enable the verbose mode -v for the plugin:

/usr/local/nagios/libexec/check_ldaps -H dc01.domain.local -b ” -p 636 -v

But it returned the below error message:

ldap_bind: Can’t contact LDAP server (-1)
additional info: TLS error -8179:Peer’s Certificate issuer is not recognized.
Could not bind to the LDAP server

Through this, we could find that the plugin did not have a CA certificate to validate the certificate. Now let’s see how to use certificate authority (CA) certificates with the check_ldaps plugin.

How to fix ‘could not bind to the LDAP server’ error

Now let’s see how our Support Engineers resolve this error for our customers.

The check_ldap plugin makes use of OpenLDAP. However, the OpenLDAP package is installed as part of the Nagios installation because the plugins have dependencies on it but it is left in a non-configured state.

So we need to create the CA certificate on the Nagios server and configure OpenLDAP to use the certificate.

We obtain the CA certificate from our CA and copy the contents of the certificate into a file on the Nagios XI server.

For that, we open an SSH session to the Nagios server.

* Create Certificate

Here we will create a certificate file called /etc/openldap/certs/windows_ca.cer and this is from a Microsoft Windows server.

So, we execute this command:

vi /etc/openldap/certs/windows_ca.cer

Then we paste the contents of our CA certificate into the SSH session.

After pasting the text, if a blank line is added after every line then we need to delete all of these blank lines. We simply press dd on keyboard to delete a blank line.

Finally, we save the changes and close the file.

* Update ldap.conf

The next step would be telling OpenLDAP to use this certificate.

So we execute the below command.

vi /etc/openldap/ldap.conf

After the file opens, we press the Down arrow until we reach the end of the file.

On a new line, we type the following:

TLS_CACERT /etc/openldap/certs/windows_ca.cer

Finally, we save the changes and close the file.

* Test Plugin

Now, the check_ldaps plugin should work:

/usr/local/nagios/libexec/check_ldaps -H dc01.domain.local -b ” -p 636

If it works, the following message is produced:

LDAP OK – 0.043 seconds response time|time=0.042861s;;;0.000000

[Need any further assistance in fixing Nagios errors? – We are here to help you]

Conclusion

Today, we saw the solution our Support Engineers provide a solution this Nagios problem.