Hi,
i have an error, when I try to connect with SSL over Port 636.
In the LOG is:
[LDAPDB_GetUser] ldap_simple_bind_s() failed for user cn=administrator,dc=domain,dc=com. Result code: 81.
[ValidateUser] LDAPDB_GetUser() failed.
[HttpFilterProc] ValidateUser() failed.
The LDAP-Server has this error:
(TLS negotiation failure)
The Certifikate is OK, I think.
I have convert it to .b64 and .der but always the same error.
All works fine over port 389, without encryption.
What should I do?
Thank you.
potsbew
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
After 1 month of configuration and testing we have found the reason and it works.
It was a problem with the certifikate. You need not the server-certifikate of the ldap-server, but the trusted-root-certifikate of the certifikate-server. This is not logically :-(
The trusted-root-certifikate of the certifikate-server must not be on the ldap-server, so you can never connect to the ldap-server over ssl.
This was very confusing!
potsbew
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Hi,
i have an error, when I try to connect with SSL over Port 636.
In the LOG is:
[LDAPDB_GetUser] ldap_simple_bind_s() failed for user cn=administrator,dc=domain,dc=com. Result code: 81.
[ValidateUser] LDAPDB_GetUser() failed.
[HttpFilterProc] ValidateUser() failed.
The LDAP-Server has this error:
(TLS negotiation failure)
The Certifikate is OK, I think.
I have convert it to .b64 and .der but always the same error.
All works fine over port 389, without encryption.
What should I do?
Thank you.
potsbew
After 1 month of configuration and testing we have found the reason and it works.
It was a problem with the certifikate. You need not the server-certifikate of the ldap-server, but the trusted-root-certifikate of the certifikate-server. This is not logically :-(
The trusted-root-certifikate of the certifikate-server must not be on the ldap-server, so you can never connect to the ldap-server over ssl.
This was very confusing!
potsbew