Active Directory SSL Integration

Currently we have LDAPS configured on our AD controller with a certificate from an external PKI.  I have followed the instructions on how to add the certificate(s) to the keystore but I still get an error.

I've added the Root and the Intermediate to the cacerts file with their own alias's and then imported the server cert from the ad controller.  The error I get seems to suggest that the chain is not able to be followed:

 

Connection test failed. Response from the server:
adserver.fqdn.local:636; nested exception is javax.naming.CommunicationException: adserver.fqdn.local:636 [Root exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target]

I've tried a few other things but I can't seem to figure out how to link the certs together.  it seems like it should use the thumbprint from each cert to follow the chain of trust but doesn't seem to be working...

 

4 answers

2 accepted

1 vote
Answer accepted
Davin Studer Community Champion Sep 26, 2017

Did you restart Confluence after importing the certs? Also, try opening the keystore in "keystore explorer". See if it all looks good through there.

Davin Studer Community Champion Sep 26, 2017

Also, did you import the certs to {ConfluenceInstall}/jre/lib/security/cacerts?

1 vote
Answer accepted
Ann Worley Atlassian Team Sep 26, 2017

I imagine you saw this page, since you are aware of the cacerts truststore for Java: Unable to Connect to SSL Services due to PKIX Path Building Failed

That error PKIX path building failed is definitely an SSL error as you surmised. The article I linked above has several points to check under the resolution section. It also links to diagnostic tools that can help you find where the misconfiguration is. Sometimes it's as simple as adding the certs to the right truststore.

I didn't actually see that PKIX website...thanks for that....

C:\Program Files\Atlassian\Confluence\jre\bin>java SSLPoke ad01server.domain.local 636
Successfully connected

So it did connect successfully so the trust is in place it looks like.

You both get a gold star because once i confirmed the ssl cert, I restarted the server (which i didn't see in any of the instructions before) and its working now

Ok..another wrinkle...the LDAP connection to the AD controller is working and passing testing but I can't look up any users.

 

Test retrieve user : Failedorg.springframework.ldap.PartialResultException: nested exception is javax.naming.PartialResultException [Root exception is javax.naming.CommunicationException: domain.local:636 [Root exception is javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No name matching domain.local found]]

Obviously the ldap is pointing a the AD controller using a certificate for the ADcontroller name....and also obviously there are no certificates for just the domain.local (its just a self signed cert and NOT a SAN cert.

Why does it keep trying to just lookup domain.local when doing a user test.

Our users are just using the account part of the upn (or samAccountName) to login

Suggest an answer

Log in or Sign up to answer
Community showcase
Published Mar 12, 2019 in Confluence

Confluence Admin Certification now $150 for Community Members

More and more people are building their careers with Atlassian, and we want you to be at the front of this wave! Important Dates Start the Certification Prep Course by 2 April 2019 Take your e...

277 views 2 10
Read article

Atlassian User Groups

Connect with like-minded Atlassian users at free events near you!

Find a group

Connect with like-minded Atlassian users at free events near you!

Find my local user group

Unfortunately there are no AUG chapters near you at the moment.

Start an AUG

You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs

Groups near you