So here I am after several hours trying to track down why one of my web servers is not working. I am writing this down to vent my spleen. I have complained for years about lousy or nonexistent error messages. It seems that nobody cares, and it will never get better (especially with LLMs mediocre extruded code becoming the norm). Here is my futile scream into the uncaring wilderness.
So here’s the problem: the client is getting an error 500. No further details there. The error_log has nothing at all.
After a while I narrow it down to directories covered by LDAP authentication. Others are fine. I test the LDAP server via the ldapsearch command, it works. Try it with a bind as well, works!
After enabling trace8 output for the ldap libraries:
[Tue Sep 01 23:59:05.524995 2026] [ldap:trace2] [pid 197509:tid 197518] util_ldap.c(649): [client 10.25.132.86:62986] ldap_simple_bind() failed with server down (try 4)
So there is an error occuring, but apparently it was a secret! Only on a need-to-know basis. Wouldn’t want to scare users, you know! So, an LDAP server is returning some sort of error while doing a bind operation. But which LDAP server? What error message? I guess that’s a secret, too? Instead of scared, I am now mad.
I located the source code in Apache (./modules/ldap/util_ldap.c line 648):
if (AP_LDAP_IS_SERVER_DOWN(rc)) {
ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r,
"ldap_simple_bind() failed with server down "
"(try %d)", failures);
}
That isn’t very enlightening, we still have an error happening a few lines above, but the error message is not part of the secret error message.
A bit more digging gets me to this directive: LDAPLibraryDebug 7
Let’s try it again… After all that we get the actual error message!
TLS trace: SSL_connect:SSLv3/TLS read server certificate request
TLS certificate verification: depth: 1, err: 2, subject: /C=US/O=*****/CN=*****, issuer: /C=US/O=*****/OU=*****/CN=*****
TLS certificate verification: Error, unable to get issuer certificate
TLS trace: SSL3 alert write:fatal:unknown CA
TLS trace: SSL_connect:error in error
TLS: can't connect: error:0A000086:SSL routines::certificate verify failed (unable to get issuer certificate).
[Tue Sep 01 23:59:05.524995 2026] [ldap:trace2] [pid 197509:tid 197518] util_ldap.c(649): [client 10.25.132.86:62986] ldap_simple_bind() failed with server down (try 4)
Now I have something to work with, but why Apache is not using the same CA authorities as the rest of the system is frustrating, but at least I have something I can work with. I hope whoever decided to hide those key error messages is happy with the amount of time I wasted tracking this down.