Are you trying to fix Nagios error, could not bind to the LDAP server?

This guide will help you.

Sometimes Nagios users might encounter the error, 'Could not bind to the LDAP server' When attempting to use the check_ldap plugin. Although unsecured LDAP lookups on port 389/TCP worked fine, however attempting to establish a secure lookup on 636 or using TLS failed.

Here at Ibmi Media, as part of our Server Management Services, we regularly help our Customers to fix Nagios related issues.

What triggers Nagios error 'Could not bind to the LDAP server' ?

Recently, we had a customer who was trying and executing the check_ldaps plugin:

/usr/local/nagios/libexec/check_ldaps -H dc01.domain.local -b ” -p 636

As a result, he received the below error message:

Could not bind to the LDAP server

Also, he tried to enable the verbose mode -v for the plugin:

/usr/local/nagios/libexec/check_ldaps -H dc01.domain.local -b ” -p 636 -v

But it returned the below error message:

ldap_bind: Can’t contact LDAP server (-1)
additional info: TLS error -8179:Peer’s Certificate issuer is not recognized.
Could not bind to the LDAP server

Through this, we could find that the plugin did not have a CA certificate to validate the certificate. 

Now let's see how to use certificate authority (CA) certificates with the check_ldaps plugin.

How to resolve Nagios 'could not bind to the LDAP server' error ?

The check_ldap plugin makes use of OpenLDAP.

However, the OpenLDAP package is installed as part of the Nagios installation because the plugins have dependencies on it but it is left in a non-configured state.

So we need to create the CA certificate on the Nagios server and configure OpenLDAP to use the certificate.

We obtain the CA certificate from our CA and copy the contents of the certificate into a file on the Nagios XI server.

For that, we open an SSH session to the Nagios server.

1.  Create Certificate

Here we will create a certificate file called /etc/openldap/certs/windows_ca.cer and this is from a Microsoft Windows server.

So, we execute this command:

$ vi /etc/openldap/certs/windows_ca.cer

Then we paste the contents of our CA certificate into the SSH session.

After pasting the text, if a blank line is added after every line then we need to delete all of these blank lines.

We simply press dd on keyboard to delete a blank line.

Finally, we save the changes and close the file.

2. Update ldap.conf

The next step would be telling OpenLDAP to use this certificate.

So we execute the below command:

$ vi /etc/openldap/ldap.conf

After the file opens, we press the Down arrow until we reach the end of the file.

On a new line, we type the following:

TLS_CACERT /etc/openldap/certs/windows_ca.cer

Finally, we save the changes and close the file.

3. Test Plugin

Now, the check_ldaps plugin should work:

/usr/local/nagios/libexec/check_ldaps -H dc01.domain.local -b ” -p 636

If it works, the following message is produced:

LDAP OK – 0.043 seconds response time|time=0.042861s;;;0.000000

[Need urgent assistance in fixing Nagios errors? – We are here to help you. ]