{"action":"created","issue":{"url":"https://api.github.com/repos/saltstack/salt/issues/21311","labels_url":"https://api.github.com/repos/saltstack/salt/issues/21311/labels{/name}","comments_url":"https://api.github.com/repos/saltstack/salt/issues/21311/comments","events_url":"https://api.github.com/repos/saltstack/salt/issues/21311/events","html_url":"https://github.com/saltstack/salt/issues/21311","id":59827416,"number":21311,"title":"salt-master fails to pick up RHEL default certs","user":{"login":"getling","id":999125,"avatar_url":"https://avatars.githubusercontent.com/u/999125?v=3","gravatar_id":"","url":"https://api.github.com/users/getling","html_url":"https://github.com/getling","followers_url":"https://api.github.com/users/getling/followers","following_url":"https://api.github.com/users/getling/following{/other_user}","gists_url":"https://api.github.com/users/getling/gists{/gist_id}","starred_url":"https://api.github.com/users/getling/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/getling/subscriptions","organizations_url":"https://api.github.com/users/getling/orgs","repos_url":"https://api.github.com/users/getling/repos","events_url":"https://api.github.com/users/getling/events{/privacy}","received_events_url":"https://api.github.com/users/getling/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/saltstack/salt/labels/Bug","name":"Bug","color":"e11d21"},{"url":"https://api.github.com/repos/saltstack/salt/labels/High%20Severity","name":"High Severity","color":"ff9143"},{"url":"https://api.github.com/repos/saltstack/salt/labels/Low-Hanging%20Fruit","name":"Low-Hanging Fruit","color":"f7c6c7"},{"url":"https://api.github.com/repos/saltstack/salt/labels/P3","name":"P3","color":"0a3d77"},{"url":"https://api.github.com/repos/saltstack/salt/labels/Platform%20Mgmt","name":"Platform Mgmt","color":"006b75"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/saltstack/salt/milestones/13","html_url":"https://github.com/saltstack/salt/milestones/Approved","labels_url":"https://api.github.com/repos/saltstack/salt/milestones/13/labels","id":9265,"number":13,"title":"Approved","description":"All issues that are ready to be worked on, both bugs and features.","creator":{"login":"thatch45","id":507599,"avatar_url":"https://avatars.githubusercontent.com/u/507599?v=3","gravatar_id":"","url":"https://api.github.com/users/thatch45","html_url":"https://github.com/thatch45","followers_url":"https://api.github.com/users/thatch45/followers","following_url":"https://api.github.com/users/thatch45/following{/other_user}","gists_url":"https://api.github.com/users/thatch45/gists{/gist_id}","starred_url":"https://api.github.com/users/thatch45/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thatch45/subscriptions","organizations_url":"https://api.github.com/users/thatch45/orgs","repos_url":"https://api.github.com/users/thatch45/repos","events_url":"https://api.github.com/users/thatch45/events{/privacy}","received_events_url":"https://api.github.com/users/thatch45/received_events","type":"User","site_admin":false},"open_issues":2319,"closed_issues":2106,"state":"open","created_at":"2011-05-14T04:00:56Z","updated_at":"2015-06-08T15:25:07Z","due_on":null,"closed_at":null},"comments":4,"created_at":"2015-03-04T17:01:04Z","updated_at":"2015-06-08T17:21:27Z","closed_at":null,"body":"Attempts to use external_auth ldap with TLS enabled on RHEL 6 causes a failure due to OS trusted CA info not being loaded by salt master:\r\n ```\r\nCommandExecutionError: Failed to bind to LDAP server ldaps://server:636 as cn=user,dc=example,dc=com: {'info': \"TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user.\", 'desc': \"Can't contact LDAP server\"}\r\n```\r\nSteps to reproduce:\r\n- Configure ldap external_auth\r\n- Start salt-master\r\n- Attempt to run an authorized command.\r\n- Output: above CommandExecutionError in DEBUG log, and user receives 'Failed to authenticate!'\r\n\r\nWorkaround:\r\nStart salt-master manually with:\r\n- `LDAPTLS_CACERT=/etc/ssl/certs/ca-bundle.crt salt-master`\r\n- Commands work as expected."},"comment":{"url":"https://api.github.com/repos/saltstack/salt/issues/comments/110082274","html_url":"https://github.com/saltstack/salt/issues/21311#issuecomment-110082274","issue_url":"https://api.github.com/repos/saltstack/salt/issues/21311","id":110082274,"user":{"login":"getling","id":999125,"avatar_url":"https://avatars.githubusercontent.com/u/999125?v=3","gravatar_id":"","url":"https://api.github.com/users/getling","html_url":"https://github.com/getling","followers_url":"https://api.github.com/users/getling/followers","following_url":"https://api.github.com/users/getling/following{/other_user}","gists_url":"https://api.github.com/users/getling/gists{/gist_id}","starred_url":"https://api.github.com/users/getling/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/getling/subscriptions","organizations_url":"https://api.github.com/users/getling/orgs","repos_url":"https://api.github.com/users/getling/repos","events_url":"https://api.github.com/users/getling/events{/privacy}","received_events_url":"https://api.github.com/users/getling/received_events","type":"User","site_admin":false},"created_at":"2015-06-08T17:21:27Z","updated_at":"2015-06-08T17:21:27Z","body":"Still exists in 2015.5.0-1...alternate workaround this time as I was having difficulty getting the previous inline version working:\r\n\r\nstart() {\r\n    echo -n $\"Starting salt-master daemon: \"\r\n+    export LDAPTLS_CACERT=/etc/ssl/certs/ca-bundle.crt\r\n    if [ -f $SUSE_RELEASE ]; then"}}