ITS#9711 fix TLS ctx init for tools

The code to initialize the TLS context was being bypassed by tool startup,
causing tools to get the wrong default setting. Move it earlier to avoid
being bypassed.

diff --git a/servers/slapd/main.c b/servers/slapd/main.c
index fff83b7c2dd896b2762ae0c4c0e19136c141927b..e59117e2f30acf521db59129fcb62f4e3176e9bf 100644 (file)
--- a/servers/slapd/main.c
+++ b/servers/slapd/main.c
@@ -403,6 +403,20 @@ int main( int argc, char **argv )
 
        (void) ldap_pvt_thread_initialize();
 
+#ifdef HAVE_TLS
+       rc = ldap_create( &slap_tls_ld );
+       if ( rc ) {
+               MAIN_RETURN( rc );
+       }
+       /* Library defaults to full certificate checking. This is correct when
+        * a client is verifying a server because all servers should have a
+        * valid cert. But few clients have valid certs, so we want our default
+        * to be no checking. The config file can override this as usual.
+        */
+       rc = LDAP_OPT_X_TLS_NEVER;
+       (void) ldap_pvt_tls_set_option( slap_tls_ld, LDAP_OPT_X_TLS_REQUIRE_CERT, &rc );
+#endif
+
        serverName = lutil_progname( "slapd", argc, argv );
 
        if ( strcmp( serverName, "slapd" ) ) {
@@ -782,21 +796,6 @@ unhandled_option:;
        extops_init();
        lutil_passwd_init();
 
-#ifdef HAVE_TLS
-       rc = ldap_create( &slap_tls_ld );
-       if ( rc ) {
-               SERVICE_EXIT( ERROR_SERVICE_SPECIFIC_ERROR, 20 );
-               goto destroy;
-       }
-       /* Library defaults to full certificate checking. This is correct when
-        * a client is verifying a server because all servers should have a
-        * valid cert. But few clients have valid certs, so we want our default
-        * to be no checking. The config file can override this as usual.
-        */
-       rc = LDAP_OPT_X_TLS_NEVER;
-       (void) ldap_pvt_tls_set_option( slap_tls_ld, LDAP_OPT_X_TLS_REQUIRE_CERT, &rc );
-#endif
-
        rc = slap_init( serverMode, serverName );
        if ( rc ) {
                SERVICE_EXIT( ERROR_SERVICE_SPECIFIC_ERROR, 18 );