Solved

How to enable LDAP over SSL with a third-party certification authority?

Posted on 2016-07-27
9
57 Views
Last Modified: 2016-10-07
I am following these guide to enable the LDAPs on one of my Windows Server 2012 R2:

https://support.microsoft.com/en-us/kb/321051
http://shabaztech.com/enabling-ldaps-certificate-3rd-party-ca/

I already get the third party certificate with the extension .cer. Whenever, I try to run the command called certreq -accpet certfile.cer, it throws the following error:

Certificate Request Processor: Cannot find object or property. 0x80092004 (-2146885628 CRYPT_E_NOT_FOUND)

I tried to change the filename extension to .p7b and crt but still it gives the same error.

Can anyone please help me in this regard?
0
Comment
Question by:TAMUQITS
  • 4
  • 3
9 Comments
 
LVL 4

Expert Comment

by:Elizabeth Anderson
ID: 41730741
The error occurs because -
When generating a web certificate request from the TPAM appliance (see "Generate web certificate request" of TPAM_SysAdmin_Guide.pdf), the certificate generated by the Certificate Authority (.CER file) can only be imported back to the TPAM device where the .CSR file was generated.

What to do -
Re-issue the web certificate using the correct (or a new) certificate request generated from the appliance.

For more information - https://support.software.dell.com/kb/145596
0
 

Author Comment

by:TAMUQITS
ID: 41730776
Thanks Elizabeth,

It's not for the appliance but Windows Server 2012 R2 Domain Controller and I have generated the CSR on the same machine and saved the certificate in the same folder where request file exists.
0
 
LVL 17

Expert Comment

by:Learnctx
ID: 41736377
Try do it from the certificate GUI.

Start > Run > certlm.msc > Right click Personal > All Tasks > Import > Find the cert you want (should be a .cer) > import the certificate.

Does anything different occur? Make sure you access the machine cert store.
0
Optimizing Cloud Backup for Low Bandwidth

With cloud storage prices going down a growing number of SMBs start to use it for backup storage. Unfortunately, business data volume rarely fits the average Internet speed. This article provides an overview of main Internet speed challenges and reveals backup best practices.

 

Author Comment

by:TAMUQITS
ID: 41736401
Hi Learnctx,

Yes, I am able to import that third party certificate from Certificate GUI while accessing the machine store.
0
 
LVL 17

Expert Comment

by:Learnctx
ID: 41736458
OK, interesting you should be done then. AD should be serving up LDAPS on TCP 636.
0
 

Author Comment

by:TAMUQITS
ID: 41737083
Hi,

Is there any online tool to test my LDAPS from outside of my organization?
0
 
LVL 17

Expert Comment

by:Learnctx
ID: 41737385
From outside? Are you exposing your DC's to the Internet? :)

The best tool to test LDAP and LDAPS is ldp.exe. Open it, the connect to LDAP and set the port as 636 and enable SSL. If you can successfully bind then LDAPS is working. If you are testing from an external location then you will also need to ensure the external party has your certificate chain trusted.
0
 

Accepted Solution

by:
TAMUQITS earned 0 total points
ID: 41737393
So, folks, the issue has been resolved. In fact, there were a couple of things. 636 port was needed to be opened at our centralised firewall, I know, it should be the first thing I should have checked but sometimes you do stupid stuff. Second, I added/installed the certificates using certutil instead of certreq.
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

SSL stands for “Secure Sockets Layer” and an SSL certificate is a critical component to keeping your website safe, secured, and compliant. Any ecommerce website must have an SSL certificate to ensure the safe handling of sensitive information like…
Synchronize a new Active Directory domain with an existing Office 365 tenant
In this Micro Tutorial viewers will learn how to restore their server from Bare Metal Backup image created with Windows Server Backup feature. As an example Windows 2012R2 is used.
This tutorial will walk an individual through the process of installing the necessary services and then configuring a Windows Server 2012 system as an iSCSI target. To install the necessary roles, go to Server Manager, and select Add Roles and Featu…

809 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question