on Feb 15, 2016My connector test connection is successful when i'm using the port 389.
But during the test connector capability, we are getting an error with 389 port which has to be changed to SSL port 636. Before doing this, we need to import the SSL certificate.
Where can I import and How???
This is the error i'm getting, to overcome this, I'll use 636 port.
How to use AD's SSL certificate in RSA Via? I need a help to configure whether to import the certificate in Linux box or just to update the aveksa keystore.
As far as I know, AD connector using SSL should work without configuring any AD certificate information.
Try with port 636 and update if you are still facing issues
you can find relevant information in the installation guide (Import Trusted Certificates)
You need to import AD server certificate (if your AD has chained certs make sure you import root,intermediate and server certs in right order) in
JAVA security's cacerts keystore. I believe installation guide has more detailed instructions. After importing the certs you need to restart the RSA via L&G server.
As Vishwanath said , we need to import AD certificate in ACM server cacert in order to successfully communicate .
Without certificate, SSL handshake will not take place.
Thank you all... I have installed AD certificates on AD server, that's it. It is working now with SSL port.
Cheers!!!!
Hi Vijayabaskar Balakrishnan, can you please share the steps fou followed in order to install the certificates?
Thank you.
You just need to use the Add Role and features wizard from AD server to import Active Directory Certificate Services.
You can go to this wizard option from service manager dashboard.
Hi Vijayabaskar,
My understanding is that you:
1. Import SSL certificate into AD
2. Edit AD collector
3. Choose port 636
4. If the connection is ok and the cert properly installed in AD, the cert from AD will be pulled into the collector definition.
You are good to go.
Regards,
Diane
Hi Team,
I am getting the below connection error from AFX AD connector.
Can you please let me know, what action i need to do from my side.
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: Certificate contains critical extensions that could not be processed. at com.novell.ldap.Connection.writeMessage(Unknown Source) at com.novell.ldap.Connection.writeMessage(Unknown Source) at com.novell.ldap.Message.sendMessage(Unknown Source) at com.novell.ldap.MessageAgent.sendMessage(Unknown Source) at com.novell.ldap.LDAPConnection.sendRequestToServer(Unknown Source) at com.novell.ldap.LDAPConnection.bind(Unknown Source) at com.novell.ldap.LDAPConnection.bind(Unknown Source) at com.novell.ldap.LDAPConnection.bind(Unknown Source) at org.mule.transport.ldapx.LdapxConnector.doConnect(LdapxConnector.java:166) at com.aveksa.AFX.transport.ldap.LdapSettingsTest.runTest(LdapSettingsTest.java:68) at com.aveksa.afx.server.component.SettingsTestExecutorComponent.onCall(SettingsTestExecutorComponent.java:29) at org.mule.model.resolvers.CallableEntryPointResolver.invoke(CallableEntryPointResolver.java:46) at org.mule.model.resolvers.DefaultEntryPointResolverSet.invoke(DefaultEntryPointResolverSet.java:36) at org.mule.component.DefaultComponentLifecycleAdapter.invoke(DefaultComponentLifecycleAdapter.java:339) at org.mule.component.AbstractJavaComponent.invokeComponentInstance(AbstractJavaComponent.java:82) at org.mule.component.AbstractJavaComponent.doInvoke(AbstractJavaComponent.java:73) at org.mule.component.AbstractComponent.invokeInternal(AbstractComponent.java:122) at org.mule.component.AbstractComponent.access$000(AbstractComponent.java:57) at org.mule.component.AbstractComponent$1$1.process(AbstractComponent.java:238) at org.mule.execution.ExceptionToMessagingExceptionExecutionInterceptor.execute(ExceptionToMessagingExceptionExecutionInterceptor.java:24) at org.mule.execution.MessageProcessorNotificationExecutionInterceptor.execute(MessageProcessorNotificationExecutionInterceptor.java:58) at org.mule.execution.MessageProcessorExecutionTemplate.execute(MessageProcessorExecutionTemplate.java:44) at org.mule.processor.chain.DefaultMessageProcessorChain.doProcess(DefaultMessageProcessorChain.java:94) at org.mule.processor.chain.AbstractMessageProcessorChain.process(AbstractMessageProcessorChain.java:67) at org.mule.processor.chain.InterceptingChainLifecycleWrapper.doProcess(InterceptingChainLifecycleWrapper.java:50) at org.mule.processor.chain.AbstractMessageProcessorChain.process(AbstractMessageProcessorChain.java:67) at org.mule.processor.chain.InterceptingChainLifecycleWrapper.access$001(InterceptingChainLifecycleWrapper.java:22) at org.mule.processor.chain.InterceptingChainLifecycleWrapper$1.process(InterceptingChainLifecycleWrapper.java:66) at org.mule.execution.ExceptionToMessagingExceptionExecutionInterceptor.execute(ExceptionToMessagingExceptionExecutionInterceptor.java:24) at org.mule.execution.MessageProcessorNotificationExecutionInterceptor.execute(MessageProcessorNotificationExecutionInterceptor.java:58) at org.mule.execution.MessageProcessorExecutionTemplate.execute(MessageProcessorExecutionTemplate.java:44) at org.mule.processor.chain.InterceptingChainLifecycleWrapper.process(InterceptingChainLifecycleWrapper.java:61) at org.mule.component.AbstractComponent.process(AbstractComponent.java:156) at org.mule.execution.ExceptionToMessagingExceptionExecutionInterceptor.execute(ExceptionToMessagingExceptionExecutionInterceptor.java:24) at org.mule.execution.MessageProcessorNotificationExecutionInterceptor.execute(MessageProcessorNotificationExecutionInterceptor.java:58) at org.mule.execution.MessageProcessorExecutionTemplate.execute(MessageProcessorExecutionTemplate.java:44) at org.mule.processor.chain.DefaultMessageProcessorChain.doProcess(DefaultMessageProcessorChain.java:94) at org.mule.processor.chain.AbstractMessageProcessorChain.process(AbstractMessageProcessorChain.java:67) at org.mule.execution.ExceptionToMessagingExceptionExecutionInterceptor.execute(ExceptionToMessagingExceptionExecutionInterceptor.java:24) at org.mule.execution.MessageProcessorExecutionTemplate.execute(MessageProcessorExecutionTemplate.java:44) at org.mule.processor.AbstractInterceptingMessageProcessorBase.processNext(AbstractInterceptingMessageProcessorBase.java:102) at org.mule.interceptor.AbstractEnvelopeInterceptor.process(AbstractEnvelopeInterceptor.java:51) at org.mule.processor.AsyncInterceptingMessageProcessor.processNextTimed(AsyncInterceptingMessageProcessor.java:118) at org.mule.processor.AsyncInterceptingMessageProcessor$AsyncMessageProcessorWorker$1.process(AsyncInterceptingMessageProcessor.java:189) at org.mule.processor.AsyncInterceptingMessageProcessor$AsyncMessageProcessorWorker$1.process(AsyncInterceptingMessageProcessor.java:182) at org.mule.execution.ExecuteCallbackInterceptor.execute(ExecuteCallbackInterceptor.java:16) at org.mule.execution.HandleExceptionInterceptor.execute(HandleExceptionInterceptor.java:30) at org.mule.execution.HandleExceptionInterceptor.execute(HandleExceptionInterceptor.java:14) at org.mule.execution.BeginAndResolveTransactionInterceptor.execute(BeginAndResolveTransactionInterceptor.java:54) at org.mule.execution.ResolvePreviousTransactionInterceptor.execute(ResolvePreviousTransactionInterceptor.java:44) at org.mule.execution.SuspendXaTransactionInterceptor.execute(SuspendXaTransactionInterceptor.java:50) at org.mule.execution.ValidateTransactionalStateInterceptor.execute(ValidateTransactionalStateInterceptor.java:40) at org.mule.execution.IsolateCurrentTransactionInterceptor.execute(IsolateCurrentTransactionInterceptor.java:41) at org.mule.execution.ExternalTransactionInterceptor.execute(ExternalTransactionInterceptor.java:48) at org.mule.execution.RethrowExceptionInterceptor.execute(RethrowExceptionInterceptor.java:28) at org.mule.execution.RethrowExceptionInterceptor.execute(RethrowExceptionInterceptor.java:13)
Abhinav Singh - (Consider creating a new question/thread for the certificate validation error.) Based on the error "Certificate contains critical extensions that could not be processed", it looks like there may be something in the AD server certificate that results in the failure to validate. Inspect the AD server certificate (that fails with AFX) and compare with another endpoint server certificate (that works with AFX) to possibly see anything odd. The AD server cert can be retrieved and inspected using the following openssl commands from the AFX host machine:
1. Run the command "openssl s_client -showcerts -connect <AD-server-hostname-or-IP>:636" to retrieve the server cert. The result may look like the following:
# openssl s_client -showcerts -connect 192.168.26.120:636
CONNECTED(00000003)
depth=0 CN = 2k8r2-dc1.2k8r2-vcloud.local
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 CN = 2k8r2-dc1.2k8r2-vcloud.local
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
0 s:/CN=2k8r2-dc1.2k8r2-vcloud.local
i:/DC=local/DC=2k8r2-vcloud/CN=2k8r2-vcloud-2K8R2-DC1-CA
-----BEGIN CERTIFICATE-----
MIIGJjCCBQ6gAwIBAgIKEbu1cgABAAAACjANBgkqhkiG9w0BAQUFADBZMRUwEwYK
......
......
g2wIlCfJ2eb589axdREhZF7AIViAWWThEmJCng8lAeO7ekRE0Wahn0Pz
-----END CERTIFICATE-----
---
Server certificate
subject=/CN=2k8r2-dc1.2k8r2-vcloud.local
issuer=/DC=local/DC=2k8r2-vcloud/CN=2k8r2-vcloud-2K8R2-DC1-CA
---
Acceptable client certificate CA names
/DC=local/DC=2k8r2-vcloud/CN=2k8r2-vcloud-2K8R2-DC1-CA
/CN=2k8r2-dc1.2k8r2-vcloud.local
/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
......
2. Copy the server certificate PEM from the openssl command's response (e.g., the text shown in blue in the above example) and save to a file (e.g., ADserver.pem)
3. Run the command "openssl x509 -text -in ADserver.pem" to view/inspect details of the AD server cert. The result may look like the following:
# openssl x509 -text -in ADserver.pem
Certificate:
......
Issuer: DC=local, DC=2k8r2-vcloud, CN=2k8r2-vcloud-2K8R2-DC1-CA
Validity
Not Before: Mar 14 05:56:38 2019 GMT
Not After : Mar 13 05:56:38 2020 GMT
Subject: CN=2k8r2-dc1.2k8r2-vcloud.local
......
X509v3 extensions:
......
......
Thank you very much Najeeb.
You need to import AD server certificate (if your AD has chained certs make sure you import root,intermediate and server certs in right order) in
JAVA security's cacerts keystore. I believe installation guide has more detailed instructions. After importing the certs you need to restart the RSA via L&G server.