Go to the central audit log when you receive notice that the certificate is untrusted. For example, if the LDAP server’s SSL certificate is not trusted, this message is logged as follows:
[06/Oct/2006:14:02:48.951 -0600] INFO 14 CNN100 host1 "failed to open connection to ldaps://host2.example.com:636, error(91): Cannot connect to the LDAP server, reason: SSL_ForceHandshake failed: (-8179) Peer's Certificate issuer is not recognized." |
When you receive this sort of error, it is usually because the CA certificate has not been added to the connector’s certificate database. Run the certutil tool to see if the certificate has been added. For more information about this tool, see About the certutil and ssltap Tools.
In this example, the certificate database contains no certificates:
# /usr/sunone/servers/shared/bin/certutil -L -d /usr/sunone/servers/ isw-host1/etc/CNN100 Certificate Name Trust Attributes p Valid peer P Trusted peer (implies p) c Valid CA T Trusted CA to issue client certs (implies c) C Trusted CA to certs(only server certs for ssl) (implies c) u User cert w Send warning |
In the following example, the certificate database contains only the Active Directory CA certificate:
# /usr/sunone/servers/shared/bin/certutil -L -d /usr/sunone/servers/ isw-host1/etc/CNN100 Certificate Name Trust Attributes example.com CA C,c, p Valid peer P Trusted peer (implies p) c Valid CA T Trusted CA to issue client certs (implies c) C Trusted CA to certs(only server certs for ssl) (implies c) u User cert w Send warning |
As shown here, the trust flags of the CA certificate must be C,,. If the certificate exists and the trust flags are set properly but the connector still can not connect, then verify that the connector was restarted after adding the certificate. Use the ldapsearch command to help diagnose the problem. If ldapsearch does not accept the certificate, then neither will the connector. For example, ldapsearch can reject certificates if they are not trusted as follows:
# /usr/sunone/servers/shared/bin/ldapsearch -Z -P /usr/sunone/ servers/isw-host1/etc/CNN100 -h host2 -b "" -s base "(objectclass=*) "ldap_search: Can't contact LDAP server SSL error -8179 Peer's Certificate issuer is not recognized.) |
The -P option directs ldapsearch to use the CNN100 connector's certificate database for SSL certificate validation. After the correct certificate is added to the connector’s certificate database, verify that ldapsearch accepts the certificate, and then restart the connector.