Solved

How to enable LDAP over SSL with a third-party certification authority?

Posted on 2016-07-27
9
32 Views
Last Modified: 2016-10-07
I am following these guide to enable the LDAPs on one of my Windows Server 2012 R2:

https://support.microsoft.com/en-us/kb/321051
http://shabaztech.com/enabling-ldaps-certificate-3rd-party-ca/

I already get the third party certificate with the extension .cer. Whenever, I try to run the command called certreq -accpet certfile.cer, it throws the following error:

Certificate Request Processor: Cannot find object or property. 0x80092004 (-2146885628 CRYPT_E_NOT_FOUND)

I tried to change the filename extension to .p7b and crt but still it gives the same error.

Can anyone please help me in this regard?
0
Comment
Question by:TAMUQITS
  • 4
  • 3
9 Comments
 
LVL 4

Expert Comment

by:Elizabeth Anderson
ID: 41730741
The error occurs because -
When generating a web certificate request from the TPAM appliance (see "Generate web certificate request" of TPAM_SysAdmin_Guide.pdf), the certificate generated by the Certificate Authority (.CER file) can only be imported back to the TPAM device where the .CSR file was generated.

What to do -
Re-issue the web certificate using the correct (or a new) certificate request generated from the appliance.

For more information - https://support.software.dell.com/kb/145596
0
 

Author Comment

by:TAMUQITS
ID: 41730776
Thanks Elizabeth,

It's not for the appliance but Windows Server 2012 R2 Domain Controller and I have generated the CSR on the same machine and saved the certificate in the same folder where request file exists.
0
 
LVL 16

Expert Comment

by:Learnctx
ID: 41736377
Try do it from the certificate GUI.

Start > Run > certlm.msc > Right click Personal > All Tasks > Import > Find the cert you want (should be a .cer) > import the certificate.

Does anything different occur? Make sure you access the machine cert store.
0
 

Author Comment

by:TAMUQITS
ID: 41736401
Hi Learnctx,

Yes, I am able to import that third party certificate from Certificate GUI while accessing the machine store.
0
 
LVL 16

Expert Comment

by:Learnctx
ID: 41736458
OK, interesting you should be done then. AD should be serving up LDAPS on TCP 636.
0
 

Author Comment

by:TAMUQITS
ID: 41737083
Hi,

Is there any online tool to test my LDAPS from outside of my organization?
0
 
LVL 16

Expert Comment

by:Learnctx
ID: 41737385
From outside? Are you exposing your DC's to the Internet? :)

The best tool to test LDAP and LDAPS is ldp.exe. Open it, the connect to LDAP and set the port as 636 and enable SSL. If you can successfully bind then LDAPS is working. If you are testing from an external location then you will also need to ensure the external party has your certificate chain trusted.
0
 

Accepted Solution

by:
TAMUQITS earned 0 total points
ID: 41737393
So, folks, the issue has been resolved. In fact, there were a couple of things. 636 port was needed to be opened at our centralised firewall, I know, it should be the first thing I should have checked but sometimes you do stupid stuff. Second, I added/installed the certificates using certutil instead of certreq.
0

Join & Write a Comment

Find out how to use Active Directory data for email signature management in Microsoft Exchange and Office 365.
Since pre-biblical times, humans have sought ways to keep secrets, and share the secrets selectively.  This article explores the ways PHP can be used to hide and encrypt information.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
This tutorial will walk an individual through the process of installing of Data Protection Manager on a server running Windows Server 2012 R2, including the prerequisites. Microsoft .Net 3.5 is required. To install this feature, go to Server Manager…

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now