Re: LDAPS

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

I'm running ldp.exe on the domain controller itself.
The certificate is installed from a trusted server (Microsoft cert server)
that has a root certificate installed on all clients in AD via group policy.
The certificate on the domain controller is a "server authentication"
certificate instaled in the local store. THE CRL is in the trusted root store
(is this incorrect)?
How do i ensure that the CRL is available?
There are no secure channel errors in the event logs.

Sorry for some of the return questions but I'm quite new to certificate
services.

Thanks,

ODG

"Joe Kaplan" wrote:

Look for errors from schannel in the System event log on the client machine
that cannot connect. It usually tells what the problem is.

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--
"jx" <mc@xxxxxxxxxxx> wrote in message
news:eMBhFA1AHHA.1196@xxxxxxxxxxxxxxxxxxxxxxx
Well, there are couple of thing to look at. First does the client trust
the CA that issued the cert? Meaning that have published the CTL of the CA
(atleast on the DCs etc)? Secondly, is the CA CRL available for the
clients to access. Third, is the certificate you issued matches the
requirement for LDAPS? Can you verify that the certificate and CTL are
installed on the DCs local cert store?
HTH

"ODG" <ODG@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:C16FA043-8E4A-4C3F-909B-9F842319B0A3@xxxxxxxxxxxxxxxx
I have been trying to setup LDAPS on my domain controllers to allow an AD
password reset option from a Juniper SSL box to access AD.

I have followed the following article
http://support.microsoft.com/kb/321051
and installed the certificate and used LDP.exe to try to connect to 636
on
the domain controller but only receive the following error:

ld = ldap_sslinit("myserverver.FQDN", 636, 1);
Error <0x0> = ldap_set_option(hLdap, LDAP_OPT_PROTOCOL_VERSION,
LDAP_VERSION3);
Error <0x51> = ldap_connect(hLdap, NULL);
Server error: <empty>
Error <0x51>: Fail to connect to myserverver.FQDN

I have used netstat -a and can see that the DC is listening on port 636
so
am not sure why it's not allowing me to connect.

I'm sure I'm missing something quite straight forward but cannot see
what.

Any help would be gratefully received.

Thanks,

ODG





.

Relevant Pages

  • Re: Web Certificate for IIS Server on SBS Domain
    ... Before your reply, I actually ran across rapidssl myself, and have ordered and installed the free 30-day certificate on my site. ... I explained what you'd told me about putting my existing configuration at risk by installing Cert Services, and he said he didn't know that. ... Again, if you're just needing a cert to install on your web server to provide SSL connectivity for remote users, go with an external third-party provider. ... When you add Certificate Services on an internal network, lots of internal communications will start using pieces provided by the Cert Server instead of the defaults from Server 2003, and when things blow up, they can blow up gloriously. ...
    (microsoft.public.windows.server.sbs)
  • Re: Activesync between Windows Mobile 5 and SBS2003 gives error
    ... If you don't find a cert here that matches the URL for OWA, you need to re-run the CEICW wizard on the SBS box and re-create the self signed cert. ... I exported the certificate straight from the server. ... Treo 700wx running Windows Mobile 5. ...
    (microsoft.public.windows.server.sbs)
  • Re: Terminal Services over a VPN
    ... Create a certificate request and submit it to godaddy in order to obtain a public cert. ... You can use the wizard in IIS Manager for this by creating a new website that matches the above name (on your TS server), right-click and choose properties, directory security tab, server certificate button. ... After the install you can stop or delete the website created above since you don't need it for anything. ...
    (microsoft.public.windows.terminal_services)
  • Re: SBS 2003 Premium and Cert Services
    ... that philosphy got blown out of the equation when SBS included Exchange OWA ... "Small Business Server" which is MS claim as to why the risk of exposing the ... the Certificate Server on another server, ... >> Cert, or you could edit the properties of your Certification Authority to ...
    (microsoft.public.windows.server.sbs)
  • Re: Web Certificate for IIS Server on SBS Domain
    ... and installed the free 30-day certificate on my site. ... instructions to install Certificate Services. ... If I can find a way to issue my own cert without risking my SBS setup, ... > Server instead of the defaults from Server 2003, and when things blow up, ...
    (microsoft.public.windows.server.sbs)