ldap starttls support

main.go

@@ -50,7 +50,7 @@ var (
 	connectJSON     = connect.Flag("json", "Write output as machine-readable JSON format.").Bool()
 	connectCert     = connect.Flag("cert", "Client certificate chain for connecting to server (PEM).").ExistingFile()
 	connectKey      = connect.Flag("key", "Private key for client certificate, if not in same file (PEM).").ExistingFile()
-	connectStartTLS = connect.Flag("start-tls", "Enable StartTLS protocol (supports 'mysql', 'postgres' and 'smtp').").PlaceHolder("PROTOCOL").Enum("mysql", "postgres", "psql", "smtp")
+	connectStartTLS = connect.Flag("start-tls", "Enable StartTLS protocol (supports 'ldap', 'mysql', 'postgres' and 'smtp').").PlaceHolder("PROTOCOL").Enum("mysql", "postgres", "psql", "smtp", "ldap")
 
 	verify       = app.Command("verify", "Verify a certificate chain from file/stdin against a name.")
 	verifyFile   = verify.Arg("file", "Certificate file to dump (or stdin if not specified).").ExistingFile()

starttls/starttls.go

@@ -21,6 +21,7 @@ import (
 	"fmt"
 	"net/smtp"
 
+	"github.com/square/certigo/starttls/ldap"
 	"github.com/square/certigo/starttls/mysql"
 	"github.com/square/certigo/starttls/psql"
 )
@@ -77,6 +78,21 @@ func GetConnectionState(startTLSType, connectName, connectTo, clientCert, client
 		defer conn.Close()
 		s := conn.ConnectionState()
 		state = &s
+	case "ldap":
+		l, err := ldap.Dial("tcp", connectTo)
+		if err != nil {
+			return nil, err
+		}
+		defer l.Close()
+
+		err = l.StartTLS(tlsConfig)
+		if err != nil {
+			return nil, err
+		}
+		state, err = l.TLSConnectionState()
+		if err != nil {
+			panic(fmt.Sprintf("LDAP Connection isn't TLS after we successfully called StartTLS (%s)", err.Error()))
+		}
 	case "mysql":
 		mysql.RegisterTLSConfig("certigo", tlsConfig)
 		state, err = mysql.DumpTLS(fmt.Sprintf("certigo@tcp(%s)/?tls=certigo", connectTo))