LDAPS Server 2012 R2 Error 0

Good morning,

We're trying to get information from our DC via LDAPS and have hit a wall, so we are reaching out for some help from all you lovely people!

When trying to connect, we keep getting Error 0 messages (we are using ldp.exe to test connection):
ld = ldap_sslinit("dc1.domain.local", 636, 1);
Error 0 = ldap_set_option(hLdap, LDAP_OPT_PROTOCOL_VERSION, 3);
Error 0 = ldap_connect(hLdap, NULL);
Error 0 = ldap_get_option(hLdap,LDAP_OPT_SSL,(void*)&lv);
Host supports SSL, SSL cipher strength = 256 bits
Established connection to dc1.domain.local.
Retrieving base DSA information...
Getting 1 entries:
Dn: (RootDSE)
<blarb from here removed>
-----------

Open in new window

We've been through THIS process to create an SSL and Root Certificate and installed them on the server and that does not seem to have made any difference.

We have also checked that there is no certificate in the Service, Active Directory Domain Services Personal Store (as there have been references that we have come across where people simply had to remove a certificate from there to get things working); there is no certificate there.

We have tried creating the UseHostnameAsAlias registry key (HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ldap) and set it to 1, but that only seems to cause another error (if you connect by server name; the error above is what you get if you try to connect by FQDN):
ld = ldap_sslinit("dc1", 636, 1);
Error 0 = ldap_set_option(hLdap, LDAP_OPT_PROTOCOL_VERSION, 3);
Error 81 = ldap_connect(hLdap, NULL);
Server error: <empty>
Error <0x51>: Fail to connect to dc1.

Open in new window

Our Primary DC is a Server 2008 R2 box, we have a secondary that's 2012 R2 and a further 3 at remote sites and 2 in Azure (don't know if this would make any difference at all, but thought it worth mentioning).

Any help on this would be greatly appreciated.


Kind regards,
Kyle
Kyle AquiniAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

footechCommented:
Error 0 means there was no error.
Your connection was successful.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Kyle AquiniAuthor Commented:
Good morning footech,

Fantastic; I feel like a tit now!


Thank you very much,
Kyle
footechCommented:
Also, one way you can always verify if you don't completely trust what the application is telling you is to do a network capture.
Ensure Business Longevity with As-A-Service

Using the as-a-service approach for your business model allows you to grow your revenue stream with new practice areas, without forcing you to part ways with existing clients just because they don’t fit the mold of your new service offerings.

Download eBook
Kyle AquiniAuthor Commented:
I think I'll be trying that now as we are getting an issue when using a custom Java Application:
Logging in using ldap on port 389 works fine and returns a successful verification with a domain user account.
Logging in using ldaps on port 636 results in an SSLHandShakeException because the certificate cannot be verified.  This is when using a certificate generated by the process noted in my original post.

Is there a way that you can force ldap to use a specific certificate for server authentication or does it select one from what is available (each of the DCs have several certificate, several either including or specifically for server Authentication)?
footechCommented:
If you're using a self-signed certificate, then it has to be installed on the client trusted root certification authorities store as well.  I can't remember if Java uses it's own store or not.

If you have the certificate in the NTDS certificate store, it should be used over any other certificates (with server authentication purpose) in the Local Machine store.
Here's how to put certificate in the NTDS (AD DS) store (copied from https://technet.microsoft.com/en-us/library/dd941846(WS.10).aspx):
To import a certificate into the AD DS personal store

1.Open a command prompt as an administrator. To open a command prompt as an administrator, click Start. In Start Search, type Command Prompt. At the top of the Start menu, right-click Command Prompt, and then click Run as administrator. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes.

2.To open Microsoft Management Console (MMC), type mmc, and then press ENTER.

3.Click File, click Add/Remove Snap-in, select Certificates from the available snap-ins, and then click Add.

4.In Add or Remove Snap-ins, click Service account to view the certificates that are stored in the service's personal store, and then click Next.

5.In Add or Remove Snap-ins, click Local computer, and then click Next.

6.In Add or Remove Snap-ins, click Active Directory Domain Services, click Finish, and then click OK.

7.In the console tree, expand Certificates - Service (Active Directory Domain Services), expand Personal, and then expand Certificates.

8.To import a certificate, right-click the NTDS\Personal folder, click All Tasks, and then click Import. When the certificate is imported, client computers should be able to make SSL connections to all domain controllers in the forest.
Kyle AquiniAuthor Commented:
Hi footech,

Just to update; we have it all working now (it broke briefly after a while and then removed the cert from the ADDS store and it jumped back into life!)


Thanks for all the help with this,
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
LDAPS

From novice to tech pro — start learning today.