AD/LDAP not working

[BanditBBS]

Getting this error:

Code: Select all

Unable to authenticate: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed (unable to get local issuer certificate)

We have imported the root and issue cert and have it set to use SSL. We try both ldap and AD and both return with the above error.

[ssax]

If your XI server OS version is RedHat/CentOS/Oracle:

Take the CA certs and put them in individual files in this directory:
- NOTE: They must have a .crt extension on the files

Code: Select all

/etc/pki/ca-trust/source/anchors/

Then run these commands:

Code: Select all

update-ca-trust extract
systemctl restart httpd php-fpm

Then test it again.


If your XI server OS version is Ubuntu/Debian:

Take the CA certs and put them in individual files in this directory:
- NOTE: They must have a .crt extension on the files

Code: Select all

/usr/local/share/ca-certificates/

Then run these commands:

Code: Select all

sudo update-ca-certificates
systemctl restart apache2

Then test it again.


If that still doesn't resolve it (it should), please PM the full output of this command:
- Change your.ad_or_ldap.server before running

Code: Select all

echo 'DONE' | openssl s_client -showcerts -connect your.ad_or_ldap.server:636

And attach or PM this file:

Code: Select all

/etc/openldap/ldap.conf

[BanditBBS]

That fixed it, but php-fpm wasn't even installed so I did install that as well.

Thanks a ton!

[ssax]

Glad that fixed it!

Are you on EL7? If so, just installing php-fpm wouldn't make it work, you would need to setup apache to use PHP-FPM for it to be used, I know it can be setup but I haven't personally done it on EL7.

Only EL8+ systems have PHP-FPM setup by default, I don't think Debian/Ubuntu have it setup at all without manual intervention/setup:

https://tecadmin.net/setup-apache-php-fpm-ubuntu-20-04/

[BanditBBS]

Yeah, RHEL 7.

Thanks again

[ssax]

I'm not sure on the specifics but you should be able to look at how an el8 system is setup. Check your PMs.