Largely followed the instructions in https://support.google.com/a/answer/9089736 (SSSD (other linux distributions)) on how to set up google secure LDAP on an ubuntu client. My sssd.conf config is as follows:
[sssd]
debug_level = 7
domains = mydomain.com
[pam]
debug_level = 7
[nss]
debug_level = 7
[domain/mydomain.com]
debug_level = 7
cache_credentials = true
ldap_tls_cert = /var/google_ldap.crt
ldap_tls_key = /var/google_ldap.key
ldap_uri = ldaps://ldap.google.com:636
ldap_search_base = dc=mydomain,dc=com
id_provider = ldap
auth_provider = ldap
ldap_schema = rfc2307bis
ldap_user_uuid = entryUUID
enumerate = false
ldap_tls_cipher_suite = NORMAL:!VERS-TLS1.3`
sssd logs, nss logs and pam logs are all ok and all sssd services are running/listening. However, when doing an ldapsearch query LDAPTLS_CERT=/var/google_ldap.crt LDAPTLS_KEY=/var/google_ldap.key ldapsearch -H ldaps://ldap.google.com:636 -b dc=mydomain,dc=com '(mail=my.name@mydomain.com)' -d 7, i get the following output:
ldap_url_parse_ext(ldaps://ldap.google.com:636)
ldap_create
ldap_url_parse_ext(ldaps://ldap.google.com:636/??base)
ldap_pvt_sasl_getmech
ldap_search
put_filter: "(objectclass=*)"
put_filter: simple
put_simple_filter: "objectclass=*"
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP ldap.google.com:636
ldap_new_socket: 3
ldap_prepare_socket: 3
ldap_connect_to_host: Trying 216.239.32.58:636
ldap_pvt_connect: fd: 3 tm: -1 async: 0
attempting to connect:
connect success
TLS: peer cert untrusted or revoked (0x42)
TLS: can't connect: (unknown error code).
ldap_msgfree
ldap_err2string
ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1)
additional info: (unknown error code)
Running openssl s_client -connect ldap.google.com:636 -CAfile /etc/ssl/certs/ca-certificates.crt validates my certs against that of ldap.google.com. So I am quite confused about the error log.
Problem had nothing to do with my client-side setup, but rather configuration issues in the Google LDAP itself.