[python-ldap] Question - Usage of windows certificate store for certificate check in TLS handshake

[William Brown]

> On 31 Jan 2022, at 08:27, philipp_s_p_developer at web.de wrote:
> 
> Hello,
> 
> our objective is to connect to a domain server using LDAPS. We want to perform the TLS handshake including the step to verify the server certificate.
> 
> We have performed tests using different setups in terms of certificate chains. We used the TLS options to set OPT_X_TLS_REQUIRE_CERT to OPT_X_TLS_DEMAND. Our client runs on a Windows operating system and OpenSSL is used as the backend implementation for TLS. To provide the certificate information that is required for the validation of the server certificate, we have performed tests with both options, a PEM file and OPT_X_TLS_CACERTFILE as well as a directory of certificate files and OPT_X_TLS_CACERTDIR. Both worked as expected.
> 
> However, so far we have failed to perform the server certificate validation using trusted certificates that are located in the Certificate Stores of Windows.
> 
> Is it possible to use the Windows Certificate Stores for server certificate validation using python-ldap?
> 
> In case it is possible, what must be done to configure python-ldap accordingly?

The way that python-ldap works is that it links to and uses openldap's client libraries to actually do the network connections. That means it "depends" on how openldap client libs were installed on your system. 

It appears that it may be possible for OpenSSL to use the windows CA store, but that would require extra code to be present in the openldap code that may or may not be present.

So I would "assume" for you that it's unlikely this has been done, so you'll need to provide your CA certs in PEM format. 

Hope that helps, 



> 
> I would appreciate your help.
> 
> Best regards,
> 
> Philipp Sp.
> 
> _______________________________________________
> python-ldap mailing list
> python-ldap at python.org
> https://mail.python.org/mailman/listinfo/python-ldap

--
Sincerely,

William