Re: LDAPS connection error on 636

Is the cert installed in the personal store for the current user or the
computer account? It needs to be in the computer account. Additionally,
the certificates MMC should tell you that there is a private key associated
with the certificate. Also, the subject name on the certificate must match
the DNS name of the DC.

Are all of these things in place correctly?

There may be additional error or info messages in the Directory Service
event log as well.

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--
"Shon Miles" <ShonMiles@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:CE11A57B-5FB0-4396-9A98-5C5B5D5D24CA@xxxxxxxxxxxxxxxx
I dd see this error
--------------------------------------
Event Type: Warning
Event Source: Schannel
Event Category: None
Event ID: 36872
Date: 4/13/2007
Time: 8:33:10 AM
User: N/A
Computer: ANDC03
Description:
No suitable default server credential exists on this system. This will
prevent server applications that expect to make use of the system default
credentials from accepting SSL connections. An example of such an
application
is the directory server. Applications that manage their own credentials,
such
as the internet information server, are not affected by this.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
--------------------------------------
The cert s issued from VeriSign and I instaled per the directionsof the KB
I
listed below. The cert is in the personal folder and I am running ldp.exe
from DC it is installed on for testing.


"Joe Kaplan" wrote:

Do you see an error from schannel in the System event log that
corresponds
to the failure on either the client or the DC? Generally, SSL problems
will
be related to either the server having problems using the certificate you
issued or the client won't trust the certificate for some reason.

On the server side, sometimes the server does not have the private key
for
the cert installed correctly or the cert is in the wrong store. Also,
depending on who issued the certificate, the server may not trust it.

If the server is able to process the certificate correctly, then on the
client side, the issue is usually either that the client does not trust
the
server's cert because its issuer doesn't chain to a trusted root on the
client machine or the DNS name of the cert does not match the DNS name
used
to connect to the server.

Usually, an error from schannel in the System event log will give you
details regarding the exact nature of the problem.

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services
Programming"
http://www.directoryprogramming.net
--
"Shon Miles" <ShonMiles@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:95AB5BA1-5DB5-40ED-965F-A8631D1721EA@xxxxxxxxxxxxxxxx
I just followed this article,
http://support.microsoft.com/default.aspx/kb/321051, and I have the
cert
back
and installed and rebooted but when I do the connection attempt I get
this
message:

ld = ldap_open("ourDCname here", 636);
Error <0x51>: Fail to connect to ourDCname here.

Any ideas?





.

Relevant Pages

  • Re: Web Certificate for IIS Server on SBS Domain
    ... Before your reply, I actually ran across rapidssl myself, and have ordered and installed the free 30-day certificate on my site. ... I explained what you'd told me about putting my existing configuration at risk by installing Cert Services, and he said he didn't know that. ... Again, if you're just needing a cert to install on your web server to provide SSL connectivity for remote users, go with an external third-party provider. ... When you add Certificate Services on an internal network, lots of internal communications will start using pieces provided by the Cert Server instead of the defaults from Server 2003, and when things blow up, they can blow up gloriously. ...
    (microsoft.public.windows.server.sbs)
  • Re: Activesync between Windows Mobile 5 and SBS2003 gives error
    ... If you don't find a cert here that matches the URL for OWA, you need to re-run the CEICW wizard on the SBS box and re-create the self signed cert. ... I exported the certificate straight from the server. ... Treo 700wx running Windows Mobile 5. ...
    (microsoft.public.windows.server.sbs)
  • Re: Terminal Services over a VPN
    ... Create a certificate request and submit it to godaddy in order to obtain a public cert. ... You can use the wizard in IIS Manager for this by creating a new website that matches the above name (on your TS server), right-click and choose properties, directory security tab, server certificate button. ... After the install you can stop or delete the website created above since you don't need it for anything. ...
    (microsoft.public.windows.terminal_services)
  • Re: SBS 2003 Premium and Cert Services
    ... that philosphy got blown out of the equation when SBS included Exchange OWA ... "Small Business Server" which is MS claim as to why the risk of exposing the ... the Certificate Server on another server, ... >> Cert, or you could edit the properties of your Certification Authority to ...
    (microsoft.public.windows.server.sbs)
  • Re: Web Certificate for IIS Server on SBS Domain
    ... and installed the free 30-day certificate on my site. ... instructions to install Certificate Services. ... If I can find a way to issue my own cert without risking my SBS setup, ... > Server instead of the defaults from Server 2003, and when things blow up, ...
    (microsoft.public.windows.server.sbs)
Loading