Dear,
I'm facing issue with configuring AD AFX connector over SSL.(Certificate is imported, 636 port)
When we try to test connection, fails with following error:
LDAPException: I/O Exception on host 172.20.0.100, port 636 (91) Connect Error
javax.net.ssl.SSLException: java.net.SocketException: Connection reset
As per the above KB, updated the software to P01HF01 but the issue still persists. Any help on this.
Is the connection successful when you try over a non secure port - 389?
You might need to import AD certificate - How and where to import the SSL certificate for ActiveDirectory
Yes, it works successfully with 389
Certificate is imported as well.
Java cacerts keystore.
Make 100% sure you actually trusted the correct CA Certificate chain. AD administrators are notorious for being adamant that one cert is being used, when the domain is actually using something different. Do not accept anyone's word as to what the certificate is. The only way to be sure is to do the connection and actually retrieve the certificate. Openssl is installed on our appliances and can be used for this purpose.
>openssl s_client -connect 2k8r2-dc1.2k8r2-vcloud.local:636
Thanks for the responses. Tried fetching the certificate and imported. But, issue is there. I did see the below error when trying to telnet. Any pointers, what could be wrong with the server, so that it could rectified to connect successfully.
Can you connect over SSL using an LDAP browser? Or do you get a similar message?
It sounds like something is wrong with the connection or the AD host. I do not think this is a configuration issue on the RSA side. This may be a firewall issue. Use third party tools to confirm that the connection is reachable. If you have not already opened a support case for this I suggest you do and we can guide you through more troubleshooting options.
It sounds like something is wrong with the connection or the AD host. I do not think this is a configuration issue on the RSA side. This may be a firewall issue. Use third party tools to confirm that the connection is reachable. If you have not already opened a support case for this I suggest you do and we can guide you through more troubleshooting options.