Page 1 of 1
AD/LDAP not working
Posted: Tue Feb 15, 2022 2:39 pm
by BanditBBS
Getting this error:
Code: Select all
Unable to authenticate: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed (unable to get local issuer certificate)
We have imported the root and issue cert and have it set to use SSL. We try both ldap and AD and both return with the above error.
Re: AD/LDAP not working
Posted: Wed Feb 16, 2022 11:17 am
by ssax
If your XI server OS version is RedHat/CentOS/Oracle:
Take the CA certs and put them in individual files in this directory:
- NOTE: They must have a .crt extension on the files
Then run these commands:
Code: Select all
update-ca-trust extract
systemctl restart httpd php-fpm
Then test it again.
If your XI server OS version is Ubuntu/Debian:
Take the CA certs and put them in individual files in this directory:
- NOTE: They must have a .crt extension on the files
Then run these commands:
Code: Select all
sudo update-ca-certificates
systemctl restart apache2
Then test it again.
If that still doesn't resolve it (it should), please PM the full output of this command:
- Change
your.ad_or_ldap.server before running
Code: Select all
echo 'DONE' | openssl s_client -showcerts -connect your.ad_or_ldap.server:636
And attach or PM this file:
Re: AD/LDAP not working
Posted: Wed Feb 16, 2022 12:53 pm
by BanditBBS
That fixed it, but php-fpm wasn't even installed so I did install that as well.
Thanks a ton!
Re: AD/LDAP not working
Posted: Wed Feb 16, 2022 3:21 pm
by ssax
Glad that fixed it!
Are you on EL7? If so, just installing php-fpm wouldn't make it work, you would need to setup apache to use PHP-FPM for it to be used, I know it can be setup but I haven't personally done it on EL7.
Only EL8+ systems have PHP-FPM setup by default, I don't think Debian/Ubuntu have it setup at all without manual intervention/setup:
https://tecadmin.net/setup-apache-php-fpm-ubuntu-20-04/
Re: AD/LDAP not working
Posted: Wed Feb 16, 2022 3:25 pm
by BanditBBS
Yeah, RHEL 7.
Thanks again
Re: AD/LDAP not working
Posted: Thu Feb 17, 2022 5:13 pm
by ssax
I'm not sure on the specifics but you should be able to look at how an el8 system is setup. Check your PMs.