javax.net.ssl.SSLHandshakeException

Ryan Minty

Hi Guys,

We have a funny issue with out SSL certs and confluence install. We are seeing the following error message when we are trying to sync via LDAP.

at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:549)
Caused by: javax.naming.CommunicationException: ldaps.****:636 [Root exception is javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure]

 

The thing is that all our instances broke at the same time. I can confirm we have around 50 other services using the LDAP service fine. (this is provided by out F5 LTM to a domain controller pool)

I can confirm the following

• \lib\security\cacerts have the valid root CA (fingerprint checked)
• \lib\security\cacerts have the valid Intermediate (fingerprint checked)
• All checks within Confluence pass and valid.
• When a sync is kicked off it will start the process and randomly fail at various stages with the above message.
• nmap of ciphers on the domain controllers are all the same
• have tried the sslpoke.java but cant get it to supply any results.

 Any ideas would be awesome if you have seen this before.

Cheers

R

Jonas Andersson

I suggest you download the SSL cert of the ldaps and import that into the keystore of confluence, if not there already.

#Download:
echo "" | openssl s_client -connect yourLDAPShostname:636 -prexit 2>/dev/null | sed -n -e '/BEGIN\ CERTIFICATE/,/END\ CERTIFICATE/ p' > ldaps.pem

#Convert from pem to der:

openssl x509 -outform der -in ldaps.pem -out ldaps.der

#import it:

/PATHTOJDKKEYTOOL/keytool -import -alias ldaps -file ldaps.der -keystore /lib/security/cacerts

These commands are all linux-formated as you can see, feel free to Windows-ify them