Windows Server

The PHP ldap module on Windows is loaded as php_ldap.dll and uses the OpenLDAP client libraries. When connecting over LDAPS or using StartTLS, the server certificate is verified not by the Windows certificate store, but by the TLS layer used by OpenLDAP.

Adding the certificate to the Windows trusted certificate store is not used when verifying an LDAPS connection in php_ldap.dll and does not affect OpenLDAP. OpenLDAP must receive the path to the CA certificate or CA bundle that issued the directory service server certificate.

How it works

When a TLS connection is established, the LDAP server sends its certificate. OpenLDAP checks whether a trusted chain can be built from this certificate to a known certificate authority. If the CA certificate is not specified in the OpenLDAP configuration, the connection will fail with a certificate verification error.

On Windows, PHP LDAP usually uses the ldap.conf file. The TLS_CACERT parameter in this file defines the path to the CA certificate or bundle file. To make the PHP process use the required configuration file and certificate, set the LDAPCONF and LDAPTLS_CACERT system environment variables.

Configuration

danger

Please note:

• Commands must be run in PowerShell as administrator.
• After making the changes, restart Windows Server so that all processes receive the updated environment.

1. Create a directory for the OpenLDAP configuration:

PowerShell

New-Item -ItemType Directory -Force C:\openldap\sysconf

2. Place the CA certificate or CA bundle in the directory:

C:\openldap\sysconf\ldaps-ca-bundle.cer

The file must be in PEM/Base64 format:

-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----

If an intermediate CA is used in the infrastructure, add the full CA certificate chain to the same file.

3. Create the C:\openldap\sysconf\ldap.conf file with the following content:

text

TLS_CACERT C:/openldap/sysconf/ldaps-ca-bundle.cer

TLS_REQCERT demand

info

TLS_CACERT specifies the path to the CA bundle. It is recommended to use forward slashes / in the path.

4. Set the system environment variables for OpenLDAP:

PowerShell

[Environment]::SetEnvironmentVariable("LDAPCONF", "C:\openldap\sysconf\ldap.conf", "Machine")
[Environment]::SetEnvironmentVariable("LDAPTLS_CACERT", "C:/openldap/sysconf/ldaps-ca-bundle.cer", "Machine")

5. Restart IIS:

PowerShell

iisreset

LLM version