Skip to main content
OCLC Support

Preparing LDAPS servers for the EZproxy 8.0.5 upgrade

  1. Last updated
  2. Save as PDF

Applies to

  • Hosted EZproxy

Answer

OCLC is upgrading hosted EZproxy customers to version 8.0.5, which includes OpenSSL 3.0.15. This release may affect LDAPS authentication if your LDAP server relies on older TLS protocols, legacy cipher suites, or weak certificate keys.

 

OpenSSL 3.0.15 security updates

Released by the OpenSSL project on September 3, 2024, OpenSSL 3.0.15 is a security patch release in the OpenSSL 3.0 long-term support series. It addresses:

• CVE-2024-6119: Potential denial of service involving X.509 name checks.
• CVE-2024-5535: Potential buffer overread in `SSL_select_next_proto()`.

The release also includes fixes from earlier OpenSSL 3.0.x releases.

 

LDAPS configuration requirements for LDAP administrators

OpenSSL 3.x applies stricter security requirements than previous versions. To help ensure LDAPS connections continue to work after the EZproxy upgrade, configure your LDAP server to use:

• TLS 1.2 or higher
• Modern TLS 1.2 cipher suites. For LDAPS servers using an RSA certificate, commonly compatible options include:
  • `ECDHE-RSA-AES128-GCM-SHA256`
  • `ECDHE-RSA-AES256-GCM-SHA384`
• An LDAPS server certificate with an RSA key of at least 2048 bits

 

Older protocols, legacy cipher suites, or weaker certificate keys may prevent LDAPS authentication from connecting after the upgrade.

 

For more information, see the [OpenSSL 3.0 release notes].

Additional information

To troubleshoot an authentication failure, run the following command from a Linux terminal:

openssl s_client \
  -connect yourLDAPSservername:636 \
  -servername yourLDAPSservername \
  -tls1_2 \
  -cipher 'DEFAULT:@SECLEVEL=1' \
  -state \
  </dev/null

 

Replace `yourLDAPSservername` with the LDAPS server’s actual hostname. The output displays the negotiated protocol, cipher, and key size. Compare these values with the requirements in this article, then adjust the configuration as needed.

 

On Windows (if OpenSSL is installed), use `^` instead of `\` to continue the command across lines:

openssl s_client ^
  -connect yourLDAPSservername:636 ^
  -servername yourLDAPSservername ^
  -tls1_2 ^
  -cipher "DEFAULT:@SECLEVEL=1" ^
  -state ^
  <NUL
 

If you can’t run the command or need help interpreting its output, contact OCLC Support and include any messages returned by OpenSSL.

Page ID

70252