RFC 2830 (rfc2830) - Page 2 of 12
Lightweight Directory Access Protocol (v3): Extension for Transport Layer Security
Alternative Format: Original Text Document
RFC 2830 LDAPv3: Extension for Transport Layer Security May 2000
2.1. Requesting TLS Establishment
A client may perform a Start TLS operation by transmitting an LDAP
PDU containing an ExtendedRequest [LDAPv3] specifying the OID for the
Start TLS operation:
1.3.6.1.4.1.1466.20037
An LDAP ExtendedRequest is defined as follows:
ExtendedRequest ::= [APPLICATION 23] SEQUENCE {
requestName [0] LDAPOID,
requestValue [1] OCTET STRING OPTIONAL }
A Start TLS extended request is formed by setting the requestName
field to the OID string given above. The requestValue field is
absent. The client MUST NOT send any PDUs on this connection
following this request until it receives a Start TLS extended
response.
When a Start TLS extended request is made, the server MUST return an
LDAP PDU containing a Start TLS extended response. An LDAP
ExtendedResponse is defined as follows:
ExtendedResponse ::= [APPLICATION 24] SEQUENCE {
COMPONENTS OF LDAPResult,
responseName [10] LDAPOID OPTIONAL,
response [11] OCTET STRING OPTIONAL }
A Start TLS extended response MUST contain a responseName field which
MUST be set to the same string as that in the responseName field
present in the Start TLS extended request. The response field is
absent. The server MUST set the resultCode field to either success or
one of the other values outlined in section 2.3.
2.2. "Success" Response
If the ExtendedResponse contains a resultCode of success, this
indicates that the server is willing and able to negotiate TLS. Refer
to section 3, below, for details.
2.3. Response other than "success"
If the ExtendedResponse contains a resultCode other than success,
this indicates that the server is unwilling or unable to negotiate
TLS.
Hodges, et al. Standards Track