Mac OS X: How to Connect to an LDAPv3 Server Using a Self-Signed Certificate

You may connect to an LDAPv3 server via SSL using the Directory Services LDAPv3 plugin in cases in which you are using a self-signed certificate, or in which your certificate is not recognized.
If you are using a self-signed certificate, or are having issues with your certificate from a Certificate Authority that is not recognized, follow these instructions to allow client connections via SSL.


  1. Copy your public certificate file to a location of your choice on your Mac OS X startup disk. If you simply created a self-signed certificate, just use that certificate file in place of the Certificate Authority's public certificate.
  2. While logged in as root, open the file /etc/openldap/ldap.conf in your preferred text editor.
  3. In that file, add this line:

    TLS_CACERT

    Note: Replace "" with the actual pathname of your certificate file. It could look like:

    TLS_CACERT /Users/certificate_file


  4. To enable certificate checking, remove the line "TLS_REQCERT never", if it is present, from /etc/openldap/ldap.conf.

    Note: The default setting in /etc/openldap/ldap.conf for Mac OS X 10.3 is to disable certificate checking. This is to support self-signed certificates in the out-of-box state.


  5. Restart the computer.


Published Date: Oct 11, 2016