Adding new connection to user source - Certificate/SSL error

[psloat]

Hi all,
I am trying to add another connection to my user source in ZCM 10.3.0. Currently I have one Netware server setup as the source via LDAPS. When trying to add any other Netware server that is running LDAP I get the following error:

The wizard cannot continue for the following reason(s):
Unable to obtain a valid certificate for SSL communications using the provided connection information. Please verify that the address and port are correct and that the LDAP directory has been configured with a valid certificate.

This happens on 4 other Netware LDAP sources. I cannot connect on 389 or 636 (preferred). What certificate is the connection trying to use? I don't see any real difference in the server that works and the servers that don't. Users have no issues authentication to any of the servers using the Novell Client.

Do you have any ideas as to what might be the cause/solution?

[Anonymous_User]

psloat,

It appears that in the past few days you have not received a response to your
posting. That concerns us, and has triggered this automated reply.

Has your problem been resolved? If not, you might try one of the following options:

- Visit http://support.novell.com and search the knowledgebase and/or check all
the other self support options and support programs available.
- You could also try posting your message again. Make sure it is posted in the
correct newsgroup. (http://forums.novell.com)

Be sure to read the forum FAQ about what to expect in the way of responses:
http://forums.novell.com/faq.php

If this is a reply to a duplicate posting, please ignore and accept our apologies
and rest assured we will issue a stern reprimand to our posting bot.

Good luck!

Your Novell Forums Team
http://forums.novell.com

[carfra11]

Hi,

I'm trying to configure a user source on my environment too, and I have the same error when trying to connect via LDAPs port 636.

I have read the documentantion and I don't find anything about this problem

Do you have solved it ??

Any clue ?

Thanks for your time

I

[rroncme]

It's a bug, Shaun Pond opened a bug on this last week. I have an SR open on it as well.
The SSL checkbox is missing from the screen.
SR10644698531

[carfra11]

Thanks for your quick response, but I think my situation is different, the SSL checkbox appears.

To me, this error apears when I'm trying to configure for the first time the User Source, it's a new User Source.

Could you help me?

Thanks for your time

[rroncme]

Yes, that is a different issue.
Can you browse LDAP on the server with on of the free LDAP Browsers from the internet?
Have you used the cert from the same CA on both devices?
Have you used an ID that works for ldap authentication?
RDR

[carfra11]

Hello Ron,

first of all thanks and tell you that my User Source is an MS - Active Directory

Can you browse LDAP on the server with on of the free LDAP Browsers from the internet?
Yes, I can browse the server with a free tool LDAP browser.

Have you used the cert from the same CA on both devices?
The ZCM Primary Server has a internal CA and my Active Directory Server has its own CA, are different.

Have you used an ID that works for ldap authentication?
Yes, I use an ID that can authenticate against the AD, is the same ID that I use with the LDAP tool.

Frank

[rroncme]

I think you need the cert for your AD on the ZCM box so it can use SSL to the AD. I don't know how you would do that. Check with Novell and the DOCS fro ZCM

[rroncme]

Hey, look at that! There's a sticky at the top of this forum about using external CA's.

[carfra11]

Hi,

thanks, but the sticky at the top of this forum is for how to use a external CA when you install your Primary Servers.

My ZCM servers are installed and running with a internal CA.

[rroncme]

Yeah, changing the CA is pretty hard. As far as I know, I saw a couple of folks who tried it a while ago, but had poor results. We tried and had lots of issues, so we rebuilt using the CA for our NDS tree for all of our servers private keys. You can search the forums, or open a ticket. I thought I remembered seeing something a while ago from Craig Wilson about it.

[carfra11]

thanks for your dedication and time

Frank