[DIRSERVER-1959] Certificates corruption during replication

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 2.0.0-M15
• Fix Version/s: 2.0.0-M16
• Labels: bug
• Environment: Replication master/slave.; master with Windows server 2003 R2; slave with Windows server 2003 R2 or Windows 7
• Assignee: Kiran Ayyagari
• Reporter: Edouard BAUDRY
• Created: 17/Feb/14 14:27
• Updated: 24/Feb/14 16:40
• Resolved: 17/Feb/14 18:35

Description

Environment: "master/slave" LDAP replication.
Slave configuration:
ads-replAliasDerefMode: never
ads-replAttributes: *
ads-replConsumerId: 1
ads-replProvHostName: SLAVE-DOMAIN-NAME
ads-replProvPort: 10389
ads-replrefreshinterval: 60000
ads-replRefreshNPersist: true
ads-replSearchFilter: (objectClass=*)
ads-replSearchScope: sub
ads-replSearchSizeLimit: 0
ads-replSearchTimeOut: 0
ads-replUserDn: uid=admin,ou=system
ads-replUserPassword: password
ads-searchBaseDN: dc=data,dc=serverDownload

To reproduce this issue:
1/ Put a certificate in "master" LDAP as binary field in field "usercertificate"
2/ See with Apache Directory Studio the field "usercertificate": it's a x509v3 with all info readable
3/ wait for the replication to the "slave" LDAP
4/ see with Apache Directory Studio the field "usercertificate": "Invalid Certificate (2340 Bytes)" with "2340 bytes" the size of the certificate.

After verification, all Bytes upper than 0x7F are replaced by 0xEFBFBD.
It appears to be linked to UTF-8 encoding/decoding, but the field is a binary field.

It's blocking as I can't use replication with this issue.

Thanks in advance for your help