Active Directory SSL Integration

Currently we have LDAPS configured on our AD controller with a certificate from an external PKI.  I have followed the instructions on how to add the certificate(s) to the keystore but I still get an error.

I've added the Root and the Intermediate to the cacerts file with their own alias's and then imported the server cert from the ad controller.  The error I get seems to suggest that the chain is not able to be followed:

 

Connection test failed. Response from the server:
adserver.fqdn.local:636; nested exception is javax.naming.CommunicationException: adserver.fqdn.local:636 [Root exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target]

I've tried a few other things but I can't seem to figure out how to link the certs together.  it seems like it should use the thumbprint from each cert to follow the chain of trust but doesn't seem to be working...

 

4 answers

2 accepted

This widget could not be displayed.
Davin Studer Community Champion Sep 26, 2017

Did you restart Confluence after importing the certs? Also, try opening the keystore in "keystore explorer". See if it all looks good through there.

Davin Studer Community Champion Sep 26, 2017

Also, did you import the certs to {ConfluenceInstall}/jre/lib/security/cacerts?

This widget could not be displayed.
Ann Worley Atlassian Team Sep 26, 2017

I imagine you saw this page, since you are aware of the cacerts truststore for Java: Unable to Connect to SSL Services due to PKIX Path Building Failed

That error PKIX path building failed is definitely an SSL error as you surmised. The article I linked above has several points to check under the resolution section. It also links to diagnostic tools that can help you find where the misconfiguration is. Sometimes it's as simple as adding the certs to the right truststore.

This widget could not be displayed.

I didn't actually see that PKIX website...thanks for that....

C:\Program Files\Atlassian\Confluence\jre\bin>java SSLPoke ad01server.domain.local 636
Successfully connected

So it did connect successfully so the trust is in place it looks like.

You both get a gold star because once i confirmed the ssl cert, I restarted the server (which i didn't see in any of the instructions before) and its working now

This widget could not be displayed.

Ok..another wrinkle...the LDAP connection to the AD controller is working and passing testing but I can't look up any users.

 

Test retrieve user : Failedorg.springframework.ldap.PartialResultException: nested exception is javax.naming.PartialResultException [Root exception is javax.naming.CommunicationException: domain.local:636 [Root exception is javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No name matching domain.local found]]

Obviously the ldap is pointing a the AD controller using a certificate for the ADcontroller name....and also obviously there are no certificates for just the domain.local (its just a self signed cert and NOT a SAN cert.

Why does it keep trying to just lookup domain.local when doing a user test.

Our users are just using the account part of the upn (or samAccountName) to login

Suggest an answer

Log in or Sign up to answer
Community showcase
Posted Monday in Confluence

Why start from scratch? Introducing four new templates for Confluence Cloud

Hi my Community friends!  For those who don't know me, I'm a product marketer on the Confluence Cloud team - nice to meet you! For those of you who do, you know that I've been all up in your Co...

485 views 6 6
Join discussion

Atlassian User Groups

Connect with like-minded Atlassian users at free events near you!

Find a group

Connect with like-minded Atlassian users at free events near you!

Find my local user group

Unfortunately there are no AUG chapters near you at the moment.

Start an AUG

You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs

Groups near you