SSL handshake exception with LDAP

Question

We recently updated to Java 1.8.0-oracle-1.8.0.181.x86_64 and after that we are unable to connect to LDAB. this is something related to the

https://www.oracle.com/technetwork/java/javase/8u181-relnotes-4479407.html.

mprove LDAP support

Endpoint identification has been enabled on LDAPS connections.

To improve the robustness of LDAPS (secure LDAP over TLS ) connections, endpoint identification algorithms have been enabled by default.

Note that there may be situations where some applications that were previously able to successfully connect to an LDAPS server may no longer be able to do so. Such applications may, if they deem appropriate, disable endpoint identification using a new system property:com.sun.jndi.ldap.object.disableEndpointIdentification.

Define this system property (or set it to true) to disable endpoint identification algorithms.

Please advise what has to be done from confluence server end.

we are using data centre with 4 node. version 5.10.2

Tobias Anstett (K15t) · Answer

Hi,

there is a good documentation on this provided by Atlassian - https://confluence.atlassian.com/doc/configuring-an-ssl-connection-to-active-directory-229838458.html

Best, Tobias

Sherif Abdelfattah · Answer

Hello Parthiban,

Before jumping to disable the new endpoint identification feature, we need to check if you have actually imported all the SSL certificates into your new Java truststore: <JAVA_HOME>/jre/lib/security/cacerts ?

New JDK will come with a default truststore file that might not have the SSL certificate chain used by your LDAP server.

Could Post a snippit of the errors you see while connecting your JIRA to LDAP ?

Cheers,

Sherif