{"id":37038,"date":"2025-12-26T15:41:31","date_gmt":"2025-12-26T12:41:31","guid":{"rendered":"https:\/\/fatihsoysal.com\/blog\/?p=37038"},"modified":"2025-12-26T15:41:31","modified_gmt":"2025-12-26T12:41:31","slug":"starttls-nedir-ve-neden-kullanilir","status":"publish","type":"post","link":"https:\/\/fatihsoysal.com\/blog\/starttls-nedir-ve-neden-kullanilir\/","title":{"rendered":"STARTTLS Nedir ve Neden Kullan\u0131l\u0131r?"},"content":{"rendered":"<p><body><\/p>\n<p>OpenLDAP, dizin hizmetleri i\u00e7in yayg\u0131n olarak kullan\u0131lan a\u00e7\u0131k kaynakl\u0131 bir protokold\u00fcr. Kullan\u0131c\u0131 kimlik do\u011frulama, adres defterleri ve \u00e7e\u015fitli uygulamalar i\u00e7in merkezi bir veri depolama alan\u0131 olarak hizmet verir. Ancak, varsay\u0131lan olarak OpenLDAP ba\u011flant\u0131lar\u0131 \u015fifrelenmez ve bu da hassas verilerin a\u011f \u00fczerinde d\u00fcz metin olarak iletilmesine yol a\u00e7abilir. Bu durum, kimlik bilgileri, ki\u015fisel veriler ve di\u011fer gizli bilgilerin k\u00f6t\u00fc niyetli ki\u015filer taraf\u0131ndan ele ge\u00e7irilmesi riskini ta\u015f\u0131r.<\/p>\n<p>Bu rehberde, OpenLDAP ba\u011flant\u0131lar\u0131n\u0131 STARTTLS kullanarak nas\u0131l \u015fifreleyece\u011finizi ad\u0131m ad\u0131m a\u00e7\u0131klayaca\u011f\u0131z. STARTTLS, mevcut d\u00fcz metin ba\u011flant\u0131s\u0131 \u00fczerinden bir TLS (Transport Layer Security) \u015fifreleme katman\u0131 ba\u015flatarak ileti\u015fimi g\u00fcvenli hale getiren bir mekanizmad\u0131r. Bu sayede, g\u00fcvenlikten \u00f6d\u00fcn vermeden OpenLDAP&#8217;\u0131n standart ba\u011flant\u0131 noktas\u0131 olan 389&#8217;u kullanmaya devam edebilirsiniz.<\/p>\n<h2>STARTTLS Nedir ve Neden Kullan\u0131l\u0131r?<\/h2>\n<p>STARTTLS (Start Transport Layer Security), bir ileti\u015fim protokol\u00fcn\u00fcn ba\u015flang\u0131\u00e7ta \u015fifresiz olarak ba\u015flamas\u0131na, ancak daha sonra bir komut g\u00f6nderilerek ileti\u015fimi TLS\/SSL ile \u015fifrelemesine olanak tan\u0131yan bir protokold\u00fcr. LDAP ba\u011flam\u0131nda, istemci ilk olarak sunucuya standart (\u015fifresiz) bir ba\u011flant\u0131 kurar. Ard\u0131ndan, istemci sunucuya bir STARTTLS i\u015flemi ba\u015flatmas\u0131n\u0131 s\u00f6yler. Sunucu bu talebi kabul etti\u011finde, ileti\u015fim TLS\/SSL \u00fczerinden \u015fifrelenir ve t\u00fcm veri al\u0131\u015fveri\u015fi g\u00fcvenli bir kanal \u00fczerinden yap\u0131l\u0131r.<\/p>\n<p>STARTTLS kullanman\u0131n ba\u015fl\u0131ca nedenleri \u015funlard\u0131r:<\/p>\n<ul>\n<li><strong>Veri Gizlili\u011fi:<\/strong> A\u011f \u00fczerinden iletilen t\u00fcm verilerin (kullan\u0131c\u0131 adlar\u0131, parolalar, dizin sorgular\u0131 vb.) \u015fifrelenmesini sa\u011flar, b\u00f6ylece yetkisiz ki\u015filerin verilere eri\u015fmesini engeller.<\/li>\n<li><strong>Veri B\u00fct\u00fcnl\u00fc\u011f\u00fc:<\/strong> \u0130letilen verilerin de\u011fi\u015ftirilmedi\u011fini veya bozulmad\u0131\u011f\u0131n\u0131 garanti eder.<\/li>\n<li><strong>Kimlik Do\u011frulama:<\/strong> \u0130stemcinin sunucunun veya sunucunun istemcinin kimli\u011fini do\u011frulamas\u0131n\u0131 sa\u011flar (kar\u015f\u0131l\u0131kl\u0131 kimlik do\u011frulama yap\u0131land\u0131r\u0131lm\u0131\u015fsa), b\u00f6ylece &#8220;ortadaki adam&#8221; (man-in-the-middle) sald\u0131r\u0131lar\u0131n\u0131 \u00f6nler.<\/li>\n<li><strong>Standart Ba\u011flant\u0131 Noktas\u0131:<\/strong> LDAP&#8217;\u0131n standart 389 portunu kullanmaya devam etmenizi sa\u011flar. Bu, g\u00fcvenlik duvar\u0131 yap\u0131land\u0131rmalar\u0131n\u0131 ve a\u011f mimarisini basitle\u015ftirebilir, \u00e7\u00fcnk\u00fc LDAPS (LDAP over SSL) i\u00e7in kullan\u0131lan 636 portunu a\u00e7man\u0131za gerek kalmaz.<\/li>\n<\/ul>\n<h2>TLS\/SSL Sertifikalar\u0131n\u0131 Haz\u0131rlama<\/h2>\n<p>STARTTLS&#8217;i etkinle\u015ftirmek i\u00e7in bir TLS\/SSL sertifikas\u0131na ve \u00f6zel anahtara ihtiyac\u0131n\u0131z vard\u0131r. Bu sertifikalar, sunucunun kimli\u011fini do\u011frulamak ve \u015fifreli bir kanal olu\u015fturmak i\u00e7in kullan\u0131l\u0131r. \u00dcretim ortamlar\u0131nda genellikle bir Sertifika Yetkilisi (CA) taraf\u0131ndan imzalanm\u0131\u015f sertifikalar kullan\u0131l\u0131rken, test veya dahili ortamlar i\u00e7in kendinden imzal\u0131 (self-signed) sertifikalar kullanabilirsiniz.<\/p>\n<h3>Kendinden \u0130mzal\u0131 Sertifika Olu\u015fturma (\u00d6rnek)<\/h3>\n<p>Bu \u00f6rnekte, OpenSSL kullanarak kendinden imzal\u0131 bir sertifika ve \u00f6zel anahtar olu\u015fturaca\u011f\u0131z. Bu ad\u0131mlar\u0131 OpenLDAP sunucunuzda ger\u00e7ekle\u015ftirmeniz gerekmektedir.<\/p>\n<pre><code class=\"language-bash\">\n<h2>Sertifikalar i\u00e7in bir dizin olu\u015fturun (e\u011fer yoksa)<\/h2>\nsudo mkdir -p \/etc\/ssl\/ldap\ncd \/etc\/ssl\/ldap\n\n<h2>2048-bit \u00f6zel anahtar olu\u015fturma<\/h2>\nsudo openssl genrsa -out ldap_server.key 2048\n\n<h2>\u00d6zel anahtar\u0131n izinlerini k\u0131s\u0131tlama (sadece root okuyabilir)<\/h2>\nsudo chmod 400 ldap_server.key\n\n<h2>Kendinden imzal\u0131 sertifika olu\u015fturma (365 g\u00fcn ge\u00e7erli)<\/h2>\n<h2>COMMON NAME (CN) k\u0131sm\u0131na OpenLDAP sunucunuzun FQDN'ini (\u00f6rn: ldap.example.com) girin<\/h2>\nsudo openssl req -new -x509 -key ldap_server.key -out ldap_server.crt -days 365\n\n<h2>Sertifika dosyas\u0131n\u0131n izinlerini ayarlama (root okuyabilir, di\u011ferleri okuyabilir)<\/h2>\nsudo chmod 644 ldap_server.crt\n<\/code><\/pre>\n<p>Yukar\u0131daki komutlar sonucunda iki \u00f6nemli dosyan\u0131z olacak:<\/p>\n<ul>\n<li><code>ldap_server.key<\/code>: Sunucunuzun \u00f6zel anahtar\u0131. Bu dosyan\u0131n kesinlikle gizli kalmas\u0131 ve yaln\u0131zca root taraf\u0131ndan okunabilir olmas\u0131 gerekir.<\/li>\n<li><code>ldap_server.crt<\/code>: Sunucunuzun genel sertifikas\u0131. Bu dosya istemcilere da\u011f\u0131t\u0131lacak ve genel olarak okunabilir olmal\u0131d\u0131r.<\/li>\n<\/ul>\n<p>E\u011fer bir CA taraf\u0131ndan imzalanm\u0131\u015f sertifika kullan\u0131yorsan\u0131z, CA&#8217;n\u0131zdan ald\u0131\u011f\u0131n\u0131z sertifika dosyas\u0131n\u0131 (genellikle <code>.crt<\/code> veya <code>.pem<\/code> uzant\u0131l\u0131) ve \u00f6zel anahtar dosyas\u0131n\u0131 (genellikle <code>.key<\/code> uzant\u0131l\u0131) kullanacaks\u0131n\u0131z. Ayr\u0131ca, CA sertifikas\u0131n\u0131 (<code>ca.crt<\/code>) da edinmeniz gerekecektir.<\/p>\n<h2>OpenLDAP Sunucusunu STARTTLS \u0130\u00e7in Yap\u0131land\u0131rma<\/h2>\n<p>Modern OpenLDAP kurulumlar\u0131 genellikle <code>cn=config<\/code> dinamik yap\u0131land\u0131rma sistemini kullan\u0131r. Bu b\u00f6l\u00fcmde, <code>ldif<\/code> dosyalar\u0131 kullanarak OpenLDAP sunucusunu STARTTLS i\u00e7in nas\u0131l yap\u0131land\u0131raca\u011f\u0131m\u0131z\u0131 g\u00f6sterece\u011fiz.<\/p>\n<h3>cn=config \u00dczerinden Yap\u0131land\u0131rma<\/h3>\n<p>\u00d6ncelikle, TLS\/SSL yap\u0131land\u0131rmas\u0131n\u0131 i\u00e7eren bir <code>ldif<\/code> dosyas\u0131 olu\u015ftural\u0131m. Bu dosya, sertifika ve anahtar dosyalar\u0131m\u0131z\u0131n yollar\u0131n\u0131 OpenLDAP&#8217;a bildirecektir. Sertifika yetkilisi (CA) sertifikan\u0131z varsa, <code>olcTLSCACertificateFile<\/code> parametresini de eklemeniz gerekecektir.<\/p>\n<p><code>add_tls.ldif<\/code> ad\u0131nda bir dosya olu\u015fturun:<\/p>\n<pre><code class=\"language-ldif\">\ndn: cn=config\nchangetype: modify\nadd: olcTLSCertificateFile\nolcTLSCertificateFile: \/etc\/ssl\/ldap\/ldap_server.crt\n-\nadd: olcTLSKeyFile\nolcTLSKeyFile: \/etc\/ssl\/ldap\/ldap_server.key\n<h2>E\u011fer bir CA taraf\u0131ndan imzalanm\u0131\u015f sertifika kullan\u0131yorsan\u0131z, CA sertifikas\u0131n\u0131n yolunu da ekleyin:<\/h2>\n#-\n#add: olcTLSCACertificateFile\n#olcTLSCACertificateFile: \/etc\/ssl\/ldap\/ca.crt\n<\/code><\/pre>\n<p>Bu <code>ldif<\/code> dosyas\u0131n\u0131 OpenLDAP yap\u0131land\u0131rmas\u0131na uygulamak i\u00e7in a\u015fa\u011f\u0131daki komutu kullan\u0131n. Bu komut, sunucunun yerel UNIX soketi \u00fczerinden kimlik do\u011frulamas\u0131 yapmas\u0131n\u0131 sa\u011flar (<code>-Y EXTERNAL -H ldapi:\/\/\/<\/code>).<\/p>\n<pre><code class=\"language-bash\">\nsudo ldapadd -Y EXTERNAL -H ldapi:\/\/\/ -f add_tls.ldif\n<\/code><\/pre>\n<p>Komut ba\u015far\u0131yla \u00e7al\u0131\u015f\u0131rsa, herhangi bir \u00e7\u0131kt\u0131 vermeyebilir veya &#8220;modifying entry &#8220;cn=config&#8221;&#8221; gibi bir mesaj g\u00f6rebilirsiniz. Hata al\u0131rsan\u0131z, dosya yollar\u0131n\u0131 ve izinleri kontrol edin.<\/p>\n<p>Yap\u0131land\u0131rman\u0131n do\u011fru bir \u015fekilde uyguland\u0131\u011f\u0131n\u0131 do\u011frulamak i\u00e7in a\u015fa\u011f\u0131daki komutu kullanabilirsiniz:<\/p>\n<pre><code class=\"language-bash\">\nsudo ldapsearch -Y EXTERNAL -H ldapi:\/\/\/ -b \"cn=config\" -LLL -Q \"(objectClass=olcGlobal)\" olcTLSCertificateFile olcTLSKeyFile olcTLSCACertificateFile\n<\/code><\/pre>\n<p>Bu komut, <code>cn=config<\/code> alt\u0131ndaki global yap\u0131land\u0131rma nesnesinden TLS ile ilgili parametreleri listelemelidir.<\/p>\n<h3>OpenLDAP Servisini Yeniden Ba\u015flatma<\/h3>\n<p>Yap\u0131land\u0131rma de\u011fi\u015fikliklerinin etkili olmas\u0131 i\u00e7in OpenLDAP servisini yeniden ba\u015flatman\u0131z gerekir:<\/p>\n<pre><code class=\"language-bash\">\nsudo systemctl restart slapd\n<h2>Veya baz\u0131 sistemlerde:<\/h2>\n<h2>sudo service slapd restart<\/h2>\n<\/code><\/pre>\n<p>Servisin durumunu kontrol etmek i\u00e7in:<\/p>\n<pre><code class=\"language-bash\">\nsudo systemctl status slapd\n<\/code><\/pre>\n<p>Herhangi bir hata olup olmad\u0131\u011f\u0131n\u0131 g\u00f6rmek i\u00e7in g\u00fcnl\u00fckleri (<code>\/var\/log\/syslog<\/code>, <code>\/var\/log\/auth.log<\/code> veya <code>journalctl -xe<\/code>) kontrol edin.<\/p>\n<h2>OpenLDAP \u0130stemcilerini STARTTLS Kullanacak \u015eekilde Yap\u0131land\u0131rma<\/h2>\n<p>Sunucu taraf\u0131 yap\u0131land\u0131rmas\u0131 tamamland\u0131ktan sonra, istemcilerin de STARTTLS kullanarak ba\u011flanacak \u015fekilde yap\u0131land\u0131r\u0131lmas\u0131 gerekir. Bu, genellikle istemci sistemlerdeki <code>\/etc\/ldap\/ldap.conf<\/code> veya <code>\/etc\/openldap\/ldap.conf<\/code> dosyas\u0131nda veya uygulamalar\u0131n kendi yap\u0131land\u0131rma dosyalar\u0131nda yap\u0131l\u0131r.<\/p>\n<h3>Genel \u0130stemci Yap\u0131land\u0131rmas\u0131 (ldap.conf)<\/h3>\n<p><code>\/etc\/ldap\/ldap.conf<\/code> dosyas\u0131na a\u015fa\u011f\u0131daki sat\u0131rlar\u0131 ekleyin veya g\u00fcncelleyin:<\/p>\n<pre><code class=\"language-conf\">\n<h2>Sunucu adresini ve portunu belirtin (iste\u011fe ba\u011fl\u0131, uygulamaya g\u00f6re de\u011fi\u015fir)<\/h2>\n<h2>URI ldap:\/\/ldap.example.com:389<\/h2>\n\n<h2>STARTTLS kullanmas\u0131n\u0131 zorla<\/h2>\nTLS_STARTTLS  yes\n\n<h2>Sunucu sertifikas\u0131n\u0131 do\u011frulamak i\u00e7in CA sertifikas\u0131n\u0131n yolu<\/h2>\n<h2>E\u011fer kendinden imzal\u0131 sertifika kullan\u0131yorsan\u0131z, sunucu sertifikas\u0131n\u0131 CA olarak belirtin<\/h2>\nTLS_CACERT    \/etc\/ssl\/ldap\/ldap_server.crt\n\n<h2>Sertifika do\u011frulama gereksinimleri:<\/h2>\n<h2>never: Sertifikalar\u0131 do\u011frulama (g\u00fcvenli de\u011fil!)<\/h2>\n<h2>allow: Sertifika do\u011frulama hatas\u0131 olsa bile devam et<\/h2>\n<h2>demand: Sertifika do\u011frulama zorunlu (\u00f6nerilen)<\/h2>\nTLS_REQCERT   demand\n<\/code><\/pre>\n<p><strong>\u00d6nemli Not:<\/strong> E\u011fer CA taraf\u0131ndan imzalanm\u0131\u015f bir sertifika kullan\u0131yorsan\u0131z, <code>TLS_CACERT<\/code> sat\u0131r\u0131na CA sertifikas\u0131n\u0131n yolunu (\u00f6rn: <code>\/etc\/ssl\/certs\/ca-certificates.crt<\/code> veya kendi CA&#8217;n\u0131z\u0131n sertifikas\u0131) yazman\u0131z gerekir. Kendinden imzal\u0131 sertifika kullan\u0131yorsan\u0131z, sunucuya ait <code>ldap_server.crt<\/code> dosyas\u0131n\u0131 CA olarak belirtmek, istemcinin sunucu sertifikas\u0131na g\u00fcvenmesini sa\u011flar.<\/p>\n<h3>Ba\u011flant\u0131y\u0131 Test Etme<\/h3>\n<p><code>ldapsearch<\/code> komutunu kullanarak STARTTLS ba\u011flant\u0131s\u0131n\u0131 test edebilirsiniz. <code>-Z<\/code> parametresi STARTTLS&#8217;i etkinle\u015ftirir, <code>-ZZ<\/code> ise STARTTLS&#8217;i zorunlu k\u0131lar ve ba\u015far\u0131s\u0131z olursa ba\u011flant\u0131y\u0131 keser.<\/p>\n<pre><code class=\"language-bash\">\n<h2>STARTTLS kullanarak bir arama yap\u0131n<\/h2>\nldapsearch -H ldap:\/\/ldap.example.com -D \"cn=admin,dc=example,dc=com\" -W -b \"dc=example,dc=com\" -Z \"(uid=testuser)\"\n\n<h2>STARTTLS'i zorunlu k\u0131larak bir arama yap\u0131n<\/h2>\nldapsearch -H ldap:\/\/ldap.example.com -D \"cn=admin,dc=example,dc=com\" -W -b \"dc=example,dc=com\" -ZZ \"(uid=testuser)\"\n<\/code><\/pre>\n<p>E\u011fer ba\u011flant\u0131 ba\u015far\u0131l\u0131 olursa, LDAP dizinindeki sonu\u00e7lar\u0131 g\u00f6rmelisiniz. Herhangi bir hata al\u0131rsan\u0131z (\u00f6rne\u011fin, &#8220;ldap_start_tls: Connect error (-11)&#8221; veya &#8220;TLS: hostname does not match CN in peer certificate&#8221;), sunucu sertifikas\u0131n\u0131n Common Name (CN) alan\u0131n\u0131n istemcinin ba\u011fland\u0131\u011f\u0131 sunucu ad\u0131yla e\u015fle\u015fti\u011finden ve istemci taraf\u0131nda CA sertifikas\u0131n\u0131n do\u011fru yap\u0131land\u0131r\u0131ld\u0131\u011f\u0131ndan emin olun.<\/p>\n<h2>Sorun Giderme ve En \u0130yi Uygulamalar<\/h2>\n<h3>Yayg\u0131n Sorunlar ve \u00c7\u00f6z\u00fcmleri<\/h3>\n<ol>\n<li><strong>Sertifika veya Anahtar Dosyas\u0131 \u0130zinleri:<\/strong> \u00d6zel anahtar dosyas\u0131n\u0131n (<code>.key<\/code>) yaln\u0131zca <code>root<\/code> taraf\u0131ndan okunabilir oldu\u011fundan (<code>chmod 400<\/code>) ve sertifika dosyas\u0131n\u0131n (<code>.crt<\/code>) herkes taraf\u0131ndan okunabilir oldu\u011fundan (<code>chmod 644<\/code>) emin olun. Yanl\u0131\u015f izinler <code>slapd<\/code>&#8216;nin ba\u015flamamas\u0131na neden olabilir.<\/li>\n<li><strong>Dosya Yollar\u0131:<\/strong> <code>ldif<\/code> dosyas\u0131ndaki <code>olcTLSCertificateFile<\/code> ve <code>olcTLSKeyFile<\/code> yollar\u0131n\u0131n do\u011fru oldu\u011fundan emin olun.<\/li>\n<li><strong>Common Name (CN) Uyu\u015fmazl\u0131\u011f\u0131:<\/strong> Sertifikan\u0131n Common Name (CN) alan\u0131, istemcinin ba\u011flanmak i\u00e7in kulland\u0131\u011f\u0131 hostname ile tam olarak e\u015fle\u015fmelidir. E\u011fer istemci bir IP adresi ile ba\u011flan\u0131yorsa, sertifikada bu IP adresinin bir Subject Alternative Name (SAN) olarak bulunmas\u0131 gerekebilir.<\/li>\n<li><strong>CA Sertifikas\u0131 Eksikli\u011fi\/Yanl\u0131\u015fl\u0131\u011f\u0131:<\/strong> \u0130stemci taraf\u0131nda <code>TLS_CACERT<\/code> veya <code>TLS_CACERTDIR<\/code> do\u011fru CA sertifikas\u0131na i\u015faret etmelidir. Kendinden imzal\u0131 sertifikalar i\u00e7in, sunucunun kendi sertifikas\u0131 CA olarak belirtilmelidir.<\/li>\n<li><strong>G\u00fcvenlik Duvar\u0131:<\/strong> OpenLDAP&#8217;\u0131n 389 (veya kulland\u0131\u011f\u0131n\u0131z di\u011fer portlar) portunun g\u00fcvenlik duvar\u0131nda a\u00e7\u0131k oldu\u011fundan emin olun.<\/li>\n<li><strong>slapd Hata Ay\u0131klama:<\/strong> Sorunlar\u0131 te\u015fhis etmek i\u00e7in <code>slapd<\/code>&#8216;yi hata ay\u0131klama modunda \u00e7al\u0131\u015ft\u0131rabilirsiniz:\n<pre><code class=\"language-bash\">\n        sudo systemctl stop slapd\n        sudo slapd -d -1\n        <\/code><\/pre>\n<p>        Bu, detayl\u0131 g\u00fcnl\u00fck \u00e7\u0131kt\u0131lar\u0131 sa\u011flayarak sorunun nerede oldu\u011funu anlaman\u0131za yard\u0131mc\u0131 olacakt\u0131r. \u00c7\u0131kt\u0131y\u0131 inceledikten sonra <code>Ctrl+C<\/code> ile durdurup <code>sudo systemctl start slapd<\/code> ile normal servisi ba\u015flatmay\u0131 unutmay\u0131n.<\/li>\n<\/ol>\n<h3>En \u0130yi Uygulamalar<\/h3>\n<ul>\n<li><strong>\u00dcretim Ortam\u0131nda CA-\u0130mzal\u0131 Sertifikalar:<\/strong> G\u00fcvenilir bir Sertifika Yetkilisi (Let&#8217;s Encrypt, DigiCert vb.) taraf\u0131ndan imzalanm\u0131\u015f sertifikalar\u0131 kullan\u0131n. Bu, istemcilerin sunucuya otomatik olarak g\u00fcvenmesini sa\u011flar ve y\u00f6netim y\u00fck\u00fcn\u00fc azalt\u0131r.<\/li>\n<li><strong>Sertifika S\u00fcrelerini Takip Edin:<\/strong> Sertifikalar\u0131n\u0131z\u0131n son kullanma tarihlerini izleyin ve s\u00fcresi dolmadan yenileyin. S\u00fcresi dolmu\u015f bir sertifika ba\u011flant\u0131 hatalar\u0131na neden olur.<\/li>\n<li><strong>G\u00fc\u00e7l\u00fc \u015eifreleme Algoritmalar\u0131:<\/strong> OpenLDAP&#8217;\u0131n g\u00fc\u00e7l\u00fc TLS \u015fifreleme algoritmalar\u0131n\u0131 kullanacak \u015fekilde yap\u0131land\u0131r\u0131ld\u0131\u011f\u0131ndan emin olun. Bu, genellikle <code>olcTLSCipherSuite<\/code> gibi parametrelerle ayarlan\u0131r (bu rehberde de\u011finilmemi\u015ftir, ancak ara\u015ft\u0131r\u0131lmaya de\u011ferdir).<\/li>\n<li><strong>TLS_REQCERT demand:<\/strong> \u0130stemci yap\u0131land\u0131rmas\u0131nda <code>TLS_REQCERT demand<\/code> kullan\u0131n. Bu, istemcinin sunucu sertifikas\u0131n\u0131 mutlaka do\u011frulamas\u0131n\u0131 gerektirir ve g\u00fcvenlik zafiyetlerini \u00f6nler.<\/li>\n<li><strong>G\u00fcnl\u00fckleri \u0130zleyin:<\/strong> OpenLDAP sunucusunun ve sistemin g\u00fcnl\u00fcklerini d\u00fczenli olarak kontrol edin. TLS ba\u011flant\u0131 hatalar\u0131 veya di\u011fer g\u00fcvenlik uyar\u0131lar\u0131 burada g\u00f6r\u00fcnecektir.<\/li>\n<\/ul>\n<h2>Sonu\u00e7 ve S\u0131k\u00e7a Sorulan Sorular (SSS)<\/h2>\n<p>Bu rehberde, OpenLDAP ba\u011flant\u0131lar\u0131n\u0131 STARTTLS kullanarak nas\u0131l \u015fifreleyece\u011finizi ad\u0131m ad\u0131m \u00f6\u011frendiniz. Sertifikalar\u0131n haz\u0131rlanmas\u0131ndan sunucu ve istemci yap\u0131land\u0131rmas\u0131na kadar t\u00fcm s\u00fcre\u00e7leri ele ald\u0131k. STARTTLS&#8217;i etkinle\u015ftirerek, LDAP dizininizdeki hassas verilerin a\u011f \u00fczerinden g\u00fcvenli bir \u015fekilde iletilmesini sa\u011flam\u0131\u015f olursunuz, bu da genel sistem g\u00fcvenli\u011finiz i\u00e7in kritik bir ad\u0131md\u0131r.<\/p>\n<h3>S\u0131k\u00e7a Sorulan Sorular (SSS)<\/h3>\n<p><strong>S1: Kendinden imzal\u0131 sertifikalar \u00fcretim ortam\u0131 i\u00e7in uygun mu?<\/strong><br \/>\nC1: Hay\u0131r, genellikle uygun de\u011fildir. Kendinden imzal\u0131 sertifikalar, istemcilerin sunucuya otomatik olarak g\u00fcvenmesini sa\u011flamaz ve her istemcinin bu sertifikay\u0131 manuel olarak g\u00fcvenilir olarak eklemesini gerektirir. Bu durum, y\u00f6netim y\u00fck\u00fcn\u00fc art\u0131r\u0131r ve g\u00fcvenlik a\u00e7\u0131klar\u0131na yol a\u00e7abilir. \u00dcretim ortamlar\u0131nda, g\u00fcvenilir bir Sertifika Yetkilisi (CA) taraf\u0131ndan imzalanm\u0131\u015f sertifikalar kullan\u0131lmal\u0131d\u0131r.<\/p>\n<p><strong>S2: STARTTLS ba\u015far\u0131s\u0131z olursa ne olur?<\/strong><br \/>\nC2: E\u011fer STARTTLS i\u015flemi ba\u015far\u0131s\u0131z olursa (\u00f6rne\u011fin, sunucu sertifikas\u0131 do\u011frulanamazsa veya sunucu STARTTLS&#8217;i desteklemiyorsa), ba\u011flant\u0131 \u015fifresiz olarak devam edebilir (e\u011fer istemci yap\u0131land\u0131rmas\u0131 buna izin veriyorsa) veya tamamen kesilebilir (e\u011fer istemci <code>TLS_REQCERT demand<\/code> veya <code>-ZZ<\/code> gibi kat\u0131 bir yap\u0131land\u0131rmaya sahipse). En iyi uygulama, STARTTLS ba\u015far\u0131s\u0131z oldu\u011funda ba\u011flant\u0131n\u0131n kesilmesini sa\u011flamakt\u0131r.<\/p>\n<p><strong>S3: <code>ldaps:\/\/<\/code> ile <code>ldap:\/\/<\/code> + STARTTLS aras\u0131ndaki fark nedir?<\/strong><br \/>\nC3: <code>ldaps:\/\/<\/code> (LDAP over SSL), ba\u011flant\u0131n\u0131n ba\u015flang\u0131c\u0131ndan itibaren TLS\/SSL \u00fczerinden \u015fifrelendi\u011fi \u00f6zel bir LDAP ba\u011flant\u0131 bi\u00e7imidir ve genellikle 636 numaral\u0131 portu kullan\u0131r. <code>ldap:\/\/<\/code> + STARTTLS ise, ba\u011flant\u0131n\u0131n standart 389 portundan d\u00fcz metin olarak ba\u015flamas\u0131na, ancak daha sonra bir komutla TLS\/SSL&#8217;ye y\u00fckseltilmesine olanak tan\u0131r. Her ikisi de ayn\u0131 seviyede g\u00fcvenlik sa\u011flar, ancak farkl\u0131 ba\u015flang\u0131\u00e7 mekanizmalar\u0131na sahiptir. STARTTLS, mevcut altyap\u0131y\u0131 de\u011fi\u015ftirmeden \u015fifreleme eklemek i\u00e7in daha esnek bir yol sunar.<\/p>\n<p><strong>S4: STARTTLS&#8217;in performansa etkisi var m\u0131d\u0131r?<\/strong><br \/>\nC4: Evet, \u015fifreleme\/\u015fifre \u00e7\u00f6zme i\u015flemleri nedeniyle bir miktar performans ek y\u00fck\u00fc olabilir. Ancak modern CPU&#8217;lar ve optimize edilmi\u015f TLS k\u00fct\u00fcphaneleri sayesinde bu etki genellikle d\u00fc\u015f\u00fckt\u00fcr ve \u00e7o\u011fu durumda g\u00f6z ard\u0131 edilebilir. G\u00fcvenlik faydalar\u0131, bu k\u00fc\u00e7\u00fck performans maliyetini fazlas\u0131yla telafi eder.<\/p>\n<p><\/body><\/p>\n","protected":false},"excerpt":{"rendered":"OpenLDAP, dizin hizmetleri i\u00e7in yayg\u0131n olarak kullan\u0131lan a\u00e7\u0131k kaynakl\u0131 bir protokold\u00fcr. Kullan\u0131c\u0131 kimlik do\u011frulama, adres defterleri ve \u00e7","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[1],"tags":[],"class_list":{"0":"post-37038","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-genel","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v20.5 (Yoast SEO v25.3.1) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>STARTTLS Nedir ve Neden Kullan\u0131l\u0131r? - Kodlar\u0131n Gizemli D\u00fcnyas\u0131<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fatihsoysal.com\/blog\/starttls-nedir-ve-neden-kullanilir\/\" \/>\n<meta property=\"og:locale\" content=\"tr_TR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"STARTTLS Nedir ve Neden Kullan\u0131l\u0131r?\" \/>\n<meta property=\"og:description\" content=\"OpenLDAP, dizin hizmetleri i\u00e7in yayg\u0131n olarak kullan\u0131lan a\u00e7\u0131k kaynakl\u0131 bir protokold\u00fcr. Kullan\u0131c\u0131 kimlik do\u011frulama, adres defterleri ve \u00e7\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fatihsoysal.com\/blog\/starttls-nedir-ve-neden-kullanilir\/\" \/>\n<meta property=\"og:site_name\" content=\"Kodlar\u0131n Gizemli D\u00fcnyas\u0131\" \/>\n<meta property=\"article:published_time\" content=\"2025-12-26T12:41:31+00:00\" \/>\n<meta name=\"author\" content=\"Fatih Soysal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Yazan:\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fatih Soysal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tahmini okuma s\u00fcresi\" \/>\n\t<meta name=\"twitter:data2\" content=\"11 dakika\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/starttls-nedir-ve-neden-kullanilir\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/starttls-nedir-ve-neden-kullanilir\/\"},\"author\":{\"name\":\"Fatih Soysal\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"headline\":\"STARTTLS Nedir ve Neden Kullan\u0131l\u0131r?\",\"datePublished\":\"2025-12-26T12:41:31+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/starttls-nedir-ve-neden-kullanilir\/\"},\"wordCount\":1803,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/starttls-nedir-ve-neden-kullanilir\/#respond\"]}],\"copyrightYear\":\"2025\",\"copyrightHolder\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/starttls-nedir-ve-neden-kullanilir\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/starttls-nedir-ve-neden-kullanilir\/\",\"name\":\"STARTTLS Nedir ve Neden Kullan\u0131l\u0131r? - Kodlar\u0131n Gizemli D\u00fcnyas\u0131\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\"},\"datePublished\":\"2025-12-26T12:41:31+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/starttls-nedir-ve-neden-kullanilir\/#breadcrumb\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/starttls-nedir-ve-neden-kullanilir\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/starttls-nedir-ve-neden-kullanilir\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Anasayfa\",\"item\":\"https:\/\/fatihsoysal.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"STARTTLS Nedir ve Neden Kullan\u0131l\u0131r?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/\",\"name\":\"Fatihsoysal.com\",\"description\":\"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim\",\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"tr\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\",\"name\":\"Fatih Soysal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"tr\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"contentUrl\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"width\":512,\"height\":512,\"caption\":\"Fatih Soysal\"},\"logo\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\"},\"description\":\"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"STARTTLS Nedir ve Neden Kullan\u0131l\u0131r? - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fatihsoysal.com\/blog\/starttls-nedir-ve-neden-kullanilir\/","og_locale":"tr_TR","og_type":"article","og_title":"STARTTLS Nedir ve Neden Kullan\u0131l\u0131r?","og_description":"OpenLDAP, dizin hizmetleri i\u00e7in yayg\u0131n olarak kullan\u0131lan a\u00e7\u0131k kaynakl\u0131 bir protokold\u00fcr. Kullan\u0131c\u0131 kimlik do\u011frulama, adres defterleri ve \u00e7","og_url":"https:\/\/fatihsoysal.com\/blog\/starttls-nedir-ve-neden-kullanilir\/","og_site_name":"Kodlar\u0131n Gizemli D\u00fcnyas\u0131","article_published_time":"2025-12-26T12:41:31+00:00","author":"Fatih Soysal","twitter_card":"summary_large_image","twitter_misc":{"Yazan:":"Fatih Soysal","Tahmini okuma s\u00fcresi":"11 dakika"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fatihsoysal.com\/blog\/starttls-nedir-ve-neden-kullanilir\/#article","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/starttls-nedir-ve-neden-kullanilir\/"},"author":{"name":"Fatih Soysal","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"headline":"STARTTLS Nedir ve Neden Kullan\u0131l\u0131r?","datePublished":"2025-12-26T12:41:31+00:00","mainEntityOfPage":{"@id":"https:\/\/fatihsoysal.com\/blog\/starttls-nedir-ve-neden-kullanilir\/"},"wordCount":1803,"commentCount":0,"publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"inLanguage":"tr","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fatihsoysal.com\/blog\/starttls-nedir-ve-neden-kullanilir\/#respond"]}],"copyrightYear":"2025","copyrightHolder":{"@id":"https:\/\/fatihsoysal.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/fatihsoysal.com\/blog\/starttls-nedir-ve-neden-kullanilir\/","url":"https:\/\/fatihsoysal.com\/blog\/starttls-nedir-ve-neden-kullanilir\/","name":"STARTTLS Nedir ve Neden Kullan\u0131l\u0131r? - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/#website"},"datePublished":"2025-12-26T12:41:31+00:00","breadcrumb":{"@id":"https:\/\/fatihsoysal.com\/blog\/starttls-nedir-ve-neden-kullanilir\/#breadcrumb"},"inLanguage":"tr","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fatihsoysal.com\/blog\/starttls-nedir-ve-neden-kullanilir\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fatihsoysal.com\/blog\/starttls-nedir-ve-neden-kullanilir\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Anasayfa","item":"https:\/\/fatihsoysal.com\/blog\/"},{"@type":"ListItem","position":2,"name":"STARTTLS Nedir ve Neden Kullan\u0131l\u0131r?"}]},{"@type":"WebSite","@id":"https:\/\/fatihsoysal.com\/blog\/#website","url":"https:\/\/fatihsoysal.com\/blog\/","name":"Fatihsoysal.com","description":"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim","publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"tr"},{"@type":["Person","Organization"],"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1","name":"Fatih Soysal","image":{"@type":"ImageObject","inLanguage":"tr","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","contentUrl":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","width":512,"height":512,"caption":"Fatih Soysal"},"logo":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/"},"description":"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.","url":"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/"}]}},"yoast_meta":{"yoast_wpseo_title":"","yoast_wpseo_metadesc":"","yoast_wpseo_canonical":""},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/37038","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/comments?post=37038"}],"version-history":[{"count":1,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/37038\/revisions"}],"predecessor-version":[{"id":37039,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/37038\/revisions\/37039"}],"wp:attachment":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/media?parent=37038"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/categories?post=37038"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/tags?post=37038"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}