Correctly marked screenshot

Hi!

I think this problem goes in line with requirement for Identity Console where you need iManager to create certificates, quote from (https://www.netiq.com/documentation/identity-console/identity_console-install/data/t4est8oq6ulo.html):

You must obtain a pkcs12 server certificate with the private key to encrypt/decrypt data exchange between the Identity Console server and the back-end server. This server certificate is used to secure the http connection. You can use server certificates generated by any external CA. For more information, see Creating Server Certificate Objects. The server certificate should contain the Subject Alternative Name with IP address and DNS of the Identity Console server. Once the server certificate object is created, you must export it in .pfx format.

And Creating Server Certificate Objects points to https://www.netiq.com/documentation/edirectory-92/edir_admin/data/b1j4tpo3.html#b1j4u0cm where first step is Launch iManager. (I know Identity Console document it says "Any external CA", but we actually have eDirectory at hand...)

Back to your problem, if you don't have iManager at hand, probably only way forward is using ndsconfig as described  here: https://portal.microfocus.com/s/article/KM000019417?language=en_US

But it says that 'ndsconfig add -m SAS' will detect the missing server certificates and re-create them, so probably you first need to delete old certs. Maybe with iMonitor?

//s

HAHAHHAHA! NEVER EVER let your certificates go if you don't have a usable iManager.

Your idea of using iMonitor was good. As I did not use the default server certificates I thought it might be a good idea to delete the custom server certificate. Spoiler: it was not LDAP won't start TLS/SSL if the certificate is not present (I hoped for something like a fallback). And because I am a good boy I used the same certificate for iMonitor. Now, guess what? My iMonitor is also gone

So, back to square one.

What about iManager workstation edition? That should work, since it connects to eDirectory using ncp.

Or maybe Console2, if you still have NCP client and old Console2 installation...

//s

Yepp, iManager seems to be the only option. But, for the records: https://www.microfocus.com/productlifecycle/

So, iManager is out of support since 31st august

I have opened a service request (case) for this issue.

EDIT: using iManager Workstation worked. But... I have questions.

EDIT2: iMonitor somehow made a fallback to the default server certificate but my browser told be something about an invalid key. Also in incognito mode.

You can use an ldap browser (apache directory studio) to remove the "SSL CertificateDNS" and "SSL EC CertificateDNS" then use "ndsconfig upgrade" to regenerate them.

Run 'nldap -u && nldap -l' to reload the KMO/certificate.

--> NOT NEEDED: Then you can copy the SSCert.pem to your Identity Console.

iManager will be supported until there is support for the Unix Fanout driver in Identity Console. That is what we have been told (as we need the Fanout driver support in Identity Console to be able to ditch iManager).

There are many other things which are still not working in Identity Console, but that is our big one.

Nope, you can't. Because you cannot authenticate without SSL/TLS in standard configuration

Excuse me, I just did it in my test tree.

1) login with Apache Directory Studio - trust certificate

2) wack the two above mentioned KMO's

3) run 'ndsconfig upgrade' which regenerated the KMO (no longer expired)

4) run 'nldap -u && nldap -l' to refresh the certificate (just in case)

You actually do not need to copy SSCert.pem as it's the CA trust which has not changed (post above have been change).

When I was taking calls from people (back in the day) this was handed out more than once, to solve this and similar problems.

I think edirectory was restarted after cert has expired and now nldap does not want to start TLS services. So any ldap browser/editor is out of the question since ldaps is actually not running (unless you have allowed ldap auth to edir without ssl/tls).