Re: SSL over Ldap June 2006 Posting

Can you open a socket at all on port 636? Maybe there is a network issue?
Try telnet or portqry or something to test this. Also, sniff the wire
traffic with a network monitor and see what you can see. If you can open a
socket but can't negotiate SSL, then you should get an error in the client's
system event log from Schannel detailing the problem.

The trial cert should be fine. If there was a cert trust error, Schannel
would usually tell you that, especially if you bumped up the Schannel
logging level.

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--
"potpal" <potpal@xxxxxxxxx> wrote in message
news:1150741673.009886.249980@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Hell Joe - I've checked the system event log for errors and even
edited the registry for different levels of schannel logging. Nothing
is appearing in the logs. Using the FQDN and proper DNS name too.
Still getting the same error.

I am however using a trail cert from verisign. The trial CA for the
trial cert is a trusted root CA.

Any other suggestions?? how do you check if CRL checking is in use on a
DC


Joe Kaplan (MVP - ADSI) wrote:
Check for Schannel errors in the system event log. That is often
helpful.

Typically, SSL certs for DCs are issued with the DNS name of the DC, not
the
NetBIOS name, so you should connect using the full DNS name. SSL does
not
like name mismatches, certs it does not trust or expired certs and may
also
puke on revoked certs if CRL checking is in use.

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services
Programming"
http://www.directoryprogramming.net
--
"potpal" <potpal@xxxxxxxxx> wrote in message
news:1150486195.088352.279420@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Been seeing a lot of similar postings but none with the resolution I
was looking for so I'm reposting to re-spark the topic any assistance
is appreciated

Like others I am running Win2003 and have spent several hours trying to
connect to AD on
port 636 using LDP.exe but have not managed to make it work whether
locally
or remotely. A simple connection on port 389 works fine but on 636 I
always
get this from the client when trying to connect with ldp.exe

ld = ldap_sslinit("dcname", 636, 1);
Error <0x0> = ldap_set_option(hLdap, LDAP_OPT_PROTOCOL_VERSION,
LDAP_VERSION3);
Error <0x51> = ldap_connect(hLdap, NULL);
Server error: <empty>
Error <0x51>: Fail to connect to "dcname"

I have a cert installed on the DC. Am I missing something on the
client end?




.

Relevant Pages

  • Re: SBS 2003 and Outlook RPC over HTTP issues
    ... Your cert is barfing due to the fact that the names do not match. ... some weird certificate error now though...if you want to see it ... As pointed out by others, port 80 does NOT need to be open, and yes, ... record pointing that to your SBS, and you have port 443 open and ...
    (microsoft.public.windows.server.sbs)
  • Re: SSL Multiple Ports
    ... Please inform us of the exact steps you are taking to install the client ... the cert store is maintained by IE. ... And this is the kicker u cant use SSL on w2003 IE on any other port apart ...
    (microsoft.public.inetserver.iis)
  • Re: Microsoft Direct Push / Active Sync - cant get it working
    ... Great to hear that you got it all working on port 80! ... Sorry I'm not too familiar with the way SSL certificates are created and installed, so I can't be much help from here on out. ... I decided to see if I could get an SSL cert in place, ...
    (microsoft.public.pocketpc)
  • Re: Enable SSL, OWA not work
    ... You should see that the TCP port is 80, and the SSL port is 443. ... Can you try removing the cert and generating a new request? ... or from a CA on the Internet? ...
    (microsoft.public.exchange.admin)
  • Re: secondary domains
    ... port 587 for inbound connections, ... causes the user's client to generate a cert conflict. ... with Microsoft clients which will do STARTTLS only on port 25. ... STARTTLS doesn't allow for the client to inform the server of the ...
    (comp.mail.sendmail)
Loading