Unable to use configure AD sync to search from base DN only

[Matthew Arciniega]

I am reconfiguring our Confluence on-prem for LDAP authentication with Active Directory, to include groups that are at a secondary OU location, as we are in the process of migrating our OU structure.

As long as I have configured the "Additional User DN" and "Additional Group DN" values, secure LDAP synchronization works perfectly. But I want to NOT use these values so that the LDAP search includes the entire directory (as that seems to be the only way to get the other OUs). When I clear these fields I get: "No subject alternative DNS name matching [OurDomain.internal]".

I suspect this is not actually a cert error, since it's working just fine when I use the 'Additional' fields. What might be my issue? Thank you!

[Matthew Arciniega · Accepted solution]

Per this article, the error was happening because Follow referrals was enabled. With that turned out, I was able to clear the "Additional Group DN" field and search from the domain root. I don't know why that would make a difference in this case as opposed to when the field was filled in, but there you are.