Currently we have LDAPS configured on our AD controller with a certificate from an external PKI. I have followed the instructions on how to add the certificate(s) to the keystore but I still get an error.
I've added the Root and the Intermediate to the cacerts file with their own alias's and then imported the server cert from the ad controller. The error I get seems to suggest that the chain is not able to be followed:
Connection test failed. Response from the server:
adserver.fqdn.local:636; nested exception is javax.naming.CommunicationException: adserver.fqdn.local:636 [Root exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target]
I've tried a few other things but I can't seem to figure out how to link the certs together. it seems like it should use the thumbprint from each cert to follow the chain of trust but doesn't seem to be working...
I imagine you saw this page, since you are aware of the cacerts truststore for Java: Unable to Connect to SSL Services due to PKIX Path Building Failed
That error PKIX path building failed is definitely an SSL error as you surmised. The article I linked above has several points to check under the resolution section. It also links to diagnostic tools that can help you find where the misconfiguration is. Sometimes it's as simple as adding the certs to the right truststore.
I didn't actually see that PKIX website...thanks for that....
C:\Program Files\Atlassian\Confluence\jre\bin>java SSLPoke ad01server.domain.local 636
So it did connect successfully so the trust is in place it looks like.
You both get a gold star because once i confirmed the ssl cert, I restarted the server (which i didn't see in any of the instructions before) and its working now
Ok..another wrinkle...the LDAP connection to the AD controller is working and passing testing but I can't look up any users.
Test retrieve user : Failedorg.springframework.ldap.PartialResultException: nested exception is javax.naming.PartialResultException [Root exception is javax.naming.CommunicationException: domain.local:636 [Root exception is javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No name matching domain.local found]]
Obviously the ldap is pointing a the AD controller using a certificate for the ADcontroller name....and also obviously there are no certificates for just the domain.local (its just a self signed cert and NOT a SAN cert.
Why does it keep trying to just lookup domain.local when doing a user test.
Our users are just using the account part of the upn (or samAccountName) to login
Two vulnerabilities have been published for Confluence Server and Data Center recently: March 20, 2019 CVE-2019-3395 / CVE-2019-3396 April 17, 2019 CVE-2019-3398 The goal of this article is...
Connect with like-minded Atlassian users at free events near you!Find an event
Connect with like-minded Atlassian users at free events near you!
Unfortunately there are no Community Events near you at the moment.Host an event
You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events