ldap over SSL ASA->Windows Server 2012 or 2016

[Oleg Volkov]

Hi!

Please help me.

I try to config aaa-server ldap over ssl like:

aaa-server ADSECURE host 10.xx.xx.xx
server-port 636
ldap-base-dn DC=xxx,DC=local
ldap-group-base-dn DC=xxx,DC=local
ldap-scope subtree
ldap-naming-attribute sAMAccountName
ldap-login-password xxxxxxxxxxxxxxxx
ldap-login-dn CN=xxxx,OU=xxx,OU=xxx,DC=xxx,DC=local
ldap-over-ssl enable
server-type microsoft
ldap-attribute-map xxxxx

But it work only with 389 and not over ssl.

What I do wrong?

Thank You!

[Francesco Molino]

Hi

I believe, before starting the configuration on asa, you tested the ldaps connection to your Microsoft server using a ldap browser?
Have you imported the CA certificate into your asa to ensure the ssl handshake?

[Oleg Volkov]

Hi

How I must import certificate? and it must be with private key or only CA?

[Francesco Molino]

Hi
Just the CA certificate, no need of the private key.

Here a link that includes some screenshots using asdm:
https://www.entrustdatacard.com/knowledgebase/how-is-the-trusted-root-certificate-installed-on-a-cisco-asa-appliance


Sorry I'm not able to make some screenshots of my own right now.

[Oleg Volkov]

Problem with ssl encryption

work with any combination without dhe-*