By default, Directory Server does not communicate with Active Directory over SSL when performing on-demand password synchronization. If the default is overridden to protect this communication with SSL, then the Active Directory CA certificate must be added to the Directory Server certificate database of each master replica as described in Chapter 1, Understanding the Product, in Sun Java System Identity Synchronization for Windows 6.0 Installation and Configuration Guide.
If the Active Directory CA certificate is not added, users fail to bind to Directory Server with the error DSA is unwilling to perform. The plug-in’s log, isw-hostname /logs/SUBC100/pluginwps_log_0.txt, reports the following:
[06/Nov/2006:15:56:16.310 -0600] INFO td=0x0376DD74 logCode=81 ADRepository.cpp:310 "unable to open connection to Active Directory server at ldaps://host2.example.com:636, reason: "
If you receive these errors, you must add the Active Directory CA certificate to Directory Server’s certificate database and restart Directory Server.