Ssl – Active Directory SSL Certificate Private Key Not Attached

active-directoryssl

I am attempting to use an SSL certificate to secure LDAPS on our Active Directory, following the instructions found on Microsoft website at http://support.microsoft.com/kb/321051

I am logged on as Domain Admin on the machine where the certificate is to be storted.
I create the request and submit to our CA.
They then return the certificate.
I then import the certifcate into the Active Directory Domain Services NTDS\Personal Store.
The certificate imports and is visible.
However it is not possible to connect to LDAPs over SSL.
Investigations show that the private key has not been associated with the certificate at import.

The Domain Controller has been restarted and this caused the following error to appear in the System Log.
Event 36869 Schannel
The SSL server credential's certificate does not have a private key information property attached to it. This most often occurs when a certificate is backed up incorrectly and then later restored. This message can also indicate a certificate enrollment failure.

Clearly since this is a new key there is no backup problem.

Does anyone have any idea what I can do to get the Private Key to assoiciate with the certificate. I have been right through the process twice, revoking the original certificate. I am always logged on a domain admin.

Many thanks.

Best Answer

The certificate that's returned must be used to complete the certificate request, not just imported into the store.

See step 5 in that KB:

certreq -accept certnew.cer

This should automatically place the certificate in the store, it does not need a manual import.

Additionally, it should be in the computer's personal store, not the service's store.

Related Solutions

Ssl – Switching to LDAP over SSL for Active Directory

Active Directory will continue to listen on port 389. When an appropriate certificate is found during startup it will begin to listen for LDAPS but the non-secure LDAP behavior remains intact.

I'm having a problem finding documentation that indicates what the Active Directory client built-in to Windows clients will be. Its unclear to me whether the client will automatically attempt to perform LDAPS operations in place of LDAP operations. I'd be interested to see if somebody else can find a documentation link that explains the client behavior.

In lieu of documentation from Microsoft confirming the client behavior, I'd recommend using something like Wireshark to monitor the "before and after" network traffic.

SSL Certificate error: verify error:num=20:unable to get local issuer certificate

So this is what I see as the CA cert name:

depth=1 /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at //www.verisign.com/rpa (c)10/CN=VeriSign Class 3 International Server CA - G3
verify error:num=20:unable to get local issuer certificate
verify return:0

That was the name of the certificate that I had imported after I did the -showcerts in my second try above. I listed the certs in the keystore by doing this:

$JAVA_HOME/bin/keytool -list -v -keystore $JAVA_HOME/jre/lib/security/cacerts

I see the CA certificate in there.

Alias name: versign2006
Creation date: Jan 21, 2011
Entry type: trustedCertEntry

Owner: CN=VeriSign Class 3 International Server CA - G3, OU=Terms of use at www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US
Issuer: CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="(c) 2006 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US
Serial number: 641be820ce020813f32d4d2d95d67e67
Valid from: Sun Feb 07 19:00:00 EST 2010 until: Fri Feb 07 18:59:59 EST 2020
Certificate fingerprints:
  MD5:  BA:B0:65:B4:3B:9C:E8:40:30:21:7D:C5:C6:CD:3F:EB
  SHA1: B1:8D:9D:19:56:69:BA:0F:78:29:51:75:66:C2:5F:42:2A:27:71:04

To make sure that openssl is using the keystore that I'm using with the server, I'm using the -CAfile argument:

openssl s_client -connect the.server.edu:3269 -CAfile $JAVA_HOME/jre/lib/security/cacerts

Knowing that the java keystore for CA's has a password, I tried using the -pass pass:password option like this:

openssl s_client -connect the.server.edu:3269 -CAfile $JAVA_HOME/jre/lib/security/cacerts -pass pass:changeit

but that didn't work either.

What's funny about that is that the cacerts file has a password on it and openssl isn't complaining that it can't read the cacerts file. That seems fishy to me. Does that or anything else ring a bell?

Best Answer

Related Solutions

Ssl – Switching to LDAP over SSL for Active Directory

SSL Certificate error: verify error:num=20:unable to get local issuer certificate

Related Topic