OpenLDAP SSL integration - ACL permissions for modifying cn=config - ssl

Question

I am trying to add ssl certificates in olcTLSCertificateFile.
dn: cn=config
changetype: modify
replace: olcTLSCertificateFile
olcTLSCertificateFile: /etc/openldap/certs/file.crt
dn: cn=config
changetype: modify
replace: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/openldap/certs/file.key
I had created these certificates as Single Sign-on using OpenSSL on CentOS7.
openssl req -new -x509 -nodes -out /etc/openldap/certs/file.crt -keyout /etc/openldap/certs/file.key -days 3650
Here are the ACL permissions I have added to the using
#monitor.ldif
dn: olcDatabase={1}monitor,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external, cn=auth" read by dn.base="cn=Manager,dc=domain,dc=com" read by * none
In last, I am modifying the file and getting error:
ldapmodify -x -W -D "cn=Manager,dc=domain,dc=com" -H ldapi:/// -f certs.ldif
Enter LDAP Password:
modifying entry "cn=config"
ldap_modify: Insufficient access (50)

Answer 1

I finally found the solution. Just changed the order of key and crt file and it worked.
dn: cn=config
changetype: modify
replace: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/openldap/certs/file.key
dn: cn=config
changetype: modify
replace: olcTLSCertificateFile
olcTLSCertificateFile: /etc/openldap/certs/file.crt

Answer 2

Any reason why you are using two separate LDAP requests?
I'd strongly recommend to use a single LDAP modify request because a single LDAP write operation is atomic:
dn: cn=config
changetype: modify
replace: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/openldap/certs/file.key
-
replace: olcTLSCertificateFile
olcTLSCertificateFile: /etc/openldap/certs/file.crt
-