Solved

Microsoft AD for Secure LDAP

Posted on 2016-09-04
3
52 Views
Last Modified: 2016-09-20
Hi,

I have enable secure LDAP on my DC server, using LDP tool, I can query the LDAP at port 636.

just wonder, do I need to apply any certificate to my member server which is running the application?
0
Comment
Question by:hell_angel
  • 2
3 Comments
 
LVL 17

Accepted Solution

by:
Learnctx earned 500 total points
ID: 41784357
Your member servers must have the certificates root chain trusted. If it is your internal CA issuing the certificate you can do this via the command line from a CA or via GPO. See here: https://technet.microsoft.com/en-us/library/cc770315(v=ws.10).aspx.

If it is a public cert authority certificate you are using, most applications trust these, but if they do not then repeat the process above. For applications which do not use the Windows central cert store (certmgmt.msc) then you will need to install the certificate chain into the applications certificate store (be this a Java keystore, or whatever).

Exmaple
Some root CA-1 << goes into the trusted roots store
|__Some intermediate CA << goes into the trusted intermediate store
     |__Some issuing CA << goes into the trusted intermediate store
          |__ Your LDAPS certificate

Open in new window

0
 

Author Comment

by:hell_angel
ID: 41784367
Hi Learnctx,

thanks for that.. customer will use GlobalSign certificate. according to the provider, Windwos 2012 R2 server alrd has its chain cert installed by default. and I verified that is correct as well.

so, I no longer need to provide the server certificate to my app server right?

the uat environment is using self-signed cert, do I need to upload the self sign cert to app server as well?


they have Oracle PeopleSoft Apps, I check the Oracle article, the apps need to upload the cert at Java...
0
 
LVL 17

Assisted Solution

by:Learnctx
Learnctx earned 500 total points
ID: 41785361
Yes, anything using Java will most likely need the cert chain added to the applications keystore. Always a pain in the bum. For the GlobalSign certificate, as long as the application uses the Windows central store I doubt you will have any problems. Windows should trust the certificate. I'd say always double check though.
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

We recently endured a series of broadcast storms that caused our ISP to shut us down for brief periods of time. After going through a multitude of tests, we determined that the issue was related to Intel NIC drivers on some new HP desktop computers …
Find out how to use Active Directory data for email signature management in Microsoft Exchange and Office 365.
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …

920 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now