topic LDAPS With Self Signed Cert in Managing Users

LDAPS With Self Signed Cert

Darcon — Thu, 06 Jan 2022 22:04:50 GMT

I have been banging my head against Google trying to get Duo Auth Proxy (Ubuntu) to work with LDAPS using a self signed cert. I have confirmed that LDAPS is working using the cert I created. Ldp.exe binds LDAPS (after I import the .cer into my Windows PC), a SaaS service is able to use LDAPS, and our Meraki AD integration picked it up. I have double and triple checked my DC to make sure I have the correct cert.

Duo works fine when I comment out the LDAPS strings in the ad_client section of my config file.

The cert was created in PowerShell, and the correct hostnames are being used. I put the .PFX in the personal computer store on the Domain Controller, and exported that same .PFX in .CER Base64, then converted that to .PEM using OpenSSL.

I am using a Duo free account if that makes any difference.

Re: LDAPS With Self Signed Cert

pgp — Thu, 06 Jan 2022 23:08:31 GMT

Since the cert is self-signed, it is its own CA, and has to be added to the “SSL CA certs file” as mentioned in your error message. (Or change the Auth Proxy’s config to point to a new file containing a copy of the cert.)

Re: LDAPS With Self Signed Cert

Darcon — Thu, 06 Jan 2022 23:35:56 GMT

I am specifying the exported .PEM in the authproxy config. See below for the LDAPS parts in my config:

transport=ldaps
ssl_ca_certs_file=dc.pem exported pem in /conf
ssl_verify_hostname=true

I’ll look into the SSL CA certs file. Thanks!

Re: LDAPS With Self Signed Cert

Darcon — Fri, 07 Jan 2022 14:38:15 GMT

I created a new cert using OpenSSL on Linux and got everything working. I don’t know why it didn’t like the cert I created with PowerShell, possibly because it was a 6 year cert? The new one is only 1 year.

I generated the .KEY and .CRT, then converted the .KEY to .PFX. This was all done with OpenSSL.

Re: LDAPS With Self Signed Cert

DuoKristina — Mon, 10 Jan 2022 15:52:31 GMT

Did the first self-signed cert include “Certificate Signing” in its key usage? That is an extra requirement we have (mentioned in the description of the ad_client ssl_ca_certs_file parameter) when you use a self-signed cert. I don’t think New-SelfSignedCertificate includes that key usage by default.

Re: LDAPS With Self Signed Cert

Darcon — Mon, 10 Jan 2022 17:18:22 GMT

That was most likely it. I can’t find any reference to “Certificate Signing” in the New-SelfSignedCertificate cmdlet. All I worried about were the correct hostname/alternative names, then exported the .PFX and .CRT files. The Org/OU/etc fields were all left blank unlike my OpenSSL cert. I also had to create the .PFX using the .KEY and .CER files that were created with OpenSSL.

Hopefully this helps someone.

Re: LDAPS With Self Signed Cert

DuoKristina — Mon, 10 Jan 2022 17:34:46 GMT

-keyusage certsign

Specifies the key usages set in the key usage extension of the certificate. The acceptable values for this parameter are:

CertSign
CRLSign
DataEncipherment
DecipherOnly
DigitalSignature
EncipherOnly
KeyAgreement
KeyEncipherment
None (default)
NonRepudiation