topic Re: FMC External AD Authentication over TLS in Network Security

FMC External AD Authentication over TLS

jbeach44 — Tue, 20 Jun 2023 17:46:39 GMT

Hello,

I am using the following guide to set up AD external authentication over TLS and getting the following error:

Opening connection to LDAP server - XXXXXXXXXX:389 - ldap
Current TLS Require Cert: 4
Current TLS CACERTFILE: /var/tmp/HsmvFZQrBM/temp0.pem
Failed to issue StartTLS instruction: Connect error - -11
The directory server is up XXXXXXXXXX:389

The hostname field is set up to match the certificate installed on the DC and I am uploading the Root certificate as base64 PEM format. Not sure what the issue is, anyone run into this?

Thanks!

Re: FMC External AD Authentication over TLS

Aref Alsouqi — Wed, 21 Jun 2023 17:16:48 GMT

On the provided output I see the negotiation is happening on port 389 which is the traditional unencrypted LDAP port, not the LDAPS port. LDAPS runs on port 636 by default.

Re: FMC External AD Authentication over TLS

jbeach44 — Wed, 21 Jun 2023 17:37:17 GMT

Hey Aref,

Thanks for the reply. SSL uses port 636 but TLS uses 389 using STARTTLS, so that's not the issue. It had something to do with the root cert I was uploading, wish I could say what it was but it finally took and is working properly.

Thanks!

Re: FMC External AD Authentication over TLS

MHM Cisco World — Wed, 21 Jun 2023 17:41:02 GMT

Can I know what is issue with root cert.

Thanks alot

MHM