Symptoms

When using clientcert ldap for system auth, setting the ssl_check_peer field to disabled has no effect. It will always behave as enabled. This setting is not exposed in the GUI; the change can only be made in tmsh, but it has no lasting effect.

Impact

No way to disable ssl_check_peer. User cannot connect. Although you can use tmsh to change the setting to 'no', enabling the user to connect, any time there is a modification to ldap config, the value gets reset to 'yes', and the issue returns.

Conditions

Using clientcert ldap for system auth.

Workaround

None.

Fix Information

Setting the ssl_check_peer field is now effective for system-auth ldap configs.

Behavior Change