Active Directory LDAP SSL

Question

I'm trying to activate SSL for my Active Directory LDAP connection but am getting the following error:

"java.security.cert.CertificateException: No subject alternative DNS name matching domain.local found."

I've specified "DC1.domain.local" as hostname in server settings for the LDAP User Directory and imported DC1's computer certificate into the Java KeyStore. The Certificate has "DC1.domain.local" in SAN but not "domain.local".

Is this required eventhough I'm not specifying "domain.local" as the hostname? If so, how can I add that to the SAN?

What are the certificate requirements? Currently I include DNS name in the subject name, is SPN also needed?

Oskar_kuzaup · Answer

Hi Jennifer,

in hostname I have put DC1.domain.local and I have grabbed the DC public certificate from that server and added it to the JKS, and that certificate then (of course) has DC1.domain.local in the SAN. The error message still says "domain.local", not "DC1.domain.local".

I get 404 on the URL you posted (it works if you remove everything past the .html).
I have actually read that post before and I get it to work if I either disable "Follow Referrals" or "Secure SSL".

Looking at the "Secure SSL" option it states that it is used to verify the hostnames supplied in the SSL certificate. Disabling this seems unsecure to me.

Looking at the "Follow Referral" option I find 2 descriptions of this setting:
1. When "Follow Referrals" is enabled, requests to objects that include the Domain Component (such as dc=example,dc=local) will cause a DNS request to be made to example.local.
2. Choose whether to allow the directory server to redirect requests to other servers. It is generally needed for Active Directory servers configured without proper DNS.
It seems to me that this is what's causing the lookup to "domain.local" instead of to "DC1.domain.local" (as stated in point 1), but would disabling this cause authentication to fail if DC1 is unavailable even if DC2 is available? This would not be ideal.

For these reasons I would like to get it to work with the "Fix the certificate"-solution if possible. How would I "Fix the certificate to contain the correct name."?

Additional info:
Domain.local is the only domain in the forrest. We use DNS and both domain.local and DC1.domain.local can be resolved by the Application (JIRA) server. Both DC1 and DC2 public certificates has been added to the JKS. Both the root CA and sub CA certificates has been added to the JKS.

J van Leeuwen · Answer

Hello Oskar,

I hope this finds you well. I would recommend reviewing our KB article, java.security.cert.CertificateException: No subject alternative DNS name matching <hostname> found. It was written for Confluence but will also apply to Jira.

This type of issue can have multiple causes, however, it's important that the hostname used to connect to the LDAP server (in server settings) matches that of the SSL certificate (SAN), or Jira will not be able to connect to the directory. This is by design.

Hope this helps!

Jennifer