I use LDAP for authenticating to traveler
There are configured SSL connection via 636 in Directory assistance database.
Everything worked fine, until I began use HTTPS for Traveler.
I have SSL certificate from third party CA.
I used kyrtool for implementation.
RSA private key, 4096 bit
SHA-256
When is new server.kyr in server document, authentication via LDAP doesn’t work.
When turn back old keyfile.kyr or change LDAP connection to 389 in Directory Assistance, everything works.
If you set DEBUG_SSL_HANDSHAKE=2 on the Domino server, what messages do you see associated with the Domino → TDS connection over LDAPS? If switching the LDAP connection from SSL/TLS to plaintext makes the problem go away, the problem is probably in that space.
The Domino server server needs to know about the certificate information of the remote LDAP server it is connecting to. Please refer to the following technote:
Subject: Looks like an invalid or untrusted certificate chain on the LDAP server
This section of the log shows that Domino was processing the LDAP server’s certificate chain when it hit a fatal problem, sending an alert back to the LDAP server and reporting “X509CertChainInvalid” back up to the higher levels.
[11492:00007-965867264] 07/21/2015 02:38:52.36 PM SSLAdvanceHandshake Exit> State : 8 (HandshakeCertificate)
[11492:00007-965867264] 07/21/2015 02:38:52.36 PM SSLProcessHandshakeMessage Enter> Message: 11 State: 8 (HandshakeCertificate) Key Exchange: 1 Cipher: 0x0035 (RSA_WITH_AES_256_CBC_SHA)
[11492:00007-965867264] 07/21/2015 02:38:52.36 PM SSLProcessHandshakeMessage Enter> Message:= SSL_certificate
[11492:00007-965867264] 07/21/2015 02:38:52.37 PM SSLSendAlert> Sending an alert of 0x0 (close_notify) level 0x2 (fatal)
[11492:00007-965867264] 07/21/2015 02:38:52.37 PM SSLProcessHandshakeMessage Exit> Message: 11 State: 2 (SSLErrorClose) Key Exchange: 1 Cipher: 0x0035 (RSA_WITH_AES_256_CBC_SHA)
[11492:00007-965867264] 07/21/2015 02:38:52.37 PM SSL_Handshake> After handshake state= 2 Status= -5000
[11492:00007-965867264] 07/21/2015 02:38:52.37 PM SSL_Handshake> Exit Status = -5000
[11492:00007-965867264] 07/21/2015 02:38:52.37 PM int_MapSSLError> Mapping SSL error -5000 to 4176 [SSLHandshakeNoDone]
[11492:00007-965867264] 07/21/2015 02:38:52.37 PM SSL_Handshake> Enter
[11492:00007-965867264] 07/21/2015 02:38:52.37 PM SSL_Handshake> Current Cipher 0x0035 (RSA_WITH_AES_256_CBC_SHA)
[11492:00007-965867264] 07/21/2015 02:38:52.37 PM SSL_Handshake> After handshake2 state 2
[11492:00007-965867264] 07/21/2015 02:38:52.37 PM SSL_Handshake> Exit Status = -6986
[11492:00007-965867264] 07/21/2015 02:38:52.37 PM int_MapSSLError> Mapping SSL error -6986 to 4163 [X509CertChainInvalidErr]
Did the “old” keyring file on Domino contain any trusted roots that aren’t in the new keyring file, such as, for example, the LDAP server’s trusted root? You can view that information in both keyring files via kyrtool, and can import any missing roots from the old keyring file into the new one also using kyrtool.