Solved

How to enable LDAP over SSL with a third-party certification authority?

Posted on 2016-07-27
9
83 Views
Last Modified: 2016-10-07
I am following these guide to enable the LDAPs on one of my Windows Server 2012 R2:

https://support.microsoft.com/en-us/kb/321051
http://shabaztech.com/enabling-ldaps-certificate-3rd-party-ca/

I already get the third party certificate with the extension .cer. Whenever, I try to run the command called certreq -accpet certfile.cer, it throws the following error:

Certificate Request Processor: Cannot find object or property. 0x80092004 (-2146885628 CRYPT_E_NOT_FOUND)

I tried to change the filename extension to .p7b and crt but still it gives the same error.

Can anyone please help me in this regard?
0
Comment
Question by:TAMUQITS
  • 4
  • 3
9 Comments
 
LVL 4

Expert Comment

by:Elizabeth Anderson
ID: 41730741
The error occurs because -
When generating a web certificate request from the TPAM appliance (see "Generate web certificate request" of TPAM_SysAdmin_Guide.pdf), the certificate generated by the Certificate Authority (.CER file) can only be imported back to the TPAM device where the .CSR file was generated.

What to do -
Re-issue the web certificate using the correct (or a new) certificate request generated from the appliance.

For more information - https://support.software.dell.com/kb/145596
0
 

Author Comment

by:TAMUQITS
ID: 41730776
Thanks Elizabeth,

It's not for the appliance but Windows Server 2012 R2 Domain Controller and I have generated the CSR on the same machine and saved the certificate in the same folder where request file exists.
0
 
LVL 17

Expert Comment

by:Learnctx
ID: 41736377
Try do it from the certificate GUI.

Start > Run > certlm.msc > Right click Personal > All Tasks > Import > Find the cert you want (should be a .cer) > import the certificate.

Does anything different occur? Make sure you access the machine cert store.
0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 

Author Comment

by:TAMUQITS
ID: 41736401
Hi Learnctx,

Yes, I am able to import that third party certificate from Certificate GUI while accessing the machine store.
0
 
LVL 17

Expert Comment

by:Learnctx
ID: 41736458
OK, interesting you should be done then. AD should be serving up LDAPS on TCP 636.
0
 

Author Comment

by:TAMUQITS
ID: 41737083
Hi,

Is there any online tool to test my LDAPS from outside of my organization?
0
 
LVL 17

Expert Comment

by:Learnctx
ID: 41737385
From outside? Are you exposing your DC's to the Internet? :)

The best tool to test LDAP and LDAPS is ldp.exe. Open it, the connect to LDAP and set the port as 636 and enable SSL. If you can successfully bind then LDAPS is working. If you are testing from an external location then you will also need to ensure the external party has your certificate chain trusted.
0
 

Accepted Solution

by:
TAMUQITS earned 0 total points
ID: 41737393
So, folks, the issue has been resolved. In fact, there were a couple of things. 636 port was needed to be opened at our centralised firewall, I know, it should be the first thing I should have checked but sometimes you do stupid stuff. Second, I added/installed the certificates using certutil instead of certreq.
0

Featured Post

Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In-place Upgrading Dirsync to Azure AD Connect
This article describes my battle tested process for setting up delegation. I use this process anywhere that I need to setup delegation. In the article I will show how it applies to Active Directory
In this Micro Tutorial viewers will learn how they can get their files copied out from their unbootable system without need to use recovery services. As an example non-bootable Windows 2012R2 installation is used which has boot problems.
In this Micro Tutorial viewers will learn how to restore their server from Bare Metal Backup image created with Windows Server Backup feature. As an example Windows 2012R2 is used.

839 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question