I followed the directions here: http://support.microsoft.com/kb/321051 to set up LDAPS. I used a certificate purchased from GoDaddy. After rebooting, I cannot get the connection to work using ldp.exe. I'm thinking maybe my certificate was configured incorrectly?
The name of the server is DNSSrvr1. The DN for the server is CN=DNSSrvr1,OU=Domain Controllers,DC=mydomain,DC=com. I set up the request.inf file as follows:
;----------------- request.inf -----------------
[Version]
Signature="$Windows NT$
[NewRequest]
Subject = "CN=DNSSrvr1,OU=Domain Controllers,DC=mydomain,DC=com" ; replace with the FQDN of the DC KeySpec = 1 KeyLength = 2048 ; Can be 1024, 2048, 4096, 8192, or 16384. ; Larger key sizes are more secure, but have ; a greater impact on performance. Exportable = TRUE MachineKeySet = TRUE SMIME = False PrivateKeyArchive = FALSE UserProtected = FALSE UseExistingKeySet = FALSE ProviderName = "Microsoft RSA SChannel Cryptographic Provider" ProviderType = 12 RequestType = PKCS10 KeyUsage = 0xa0
[EnhancedKeyUsageExtension]
OID=1.3.6.1.5.5.7.3.1 ; this is for Server Authentication
;-----------------------------------------------
The certificate came back from GoDaddy for "DNSSrvr1", not the entire DN, could that be an issue?
I put the certificate in the Local Computer Personal container.
When I run the ldp.exe utility, entering either the name of the server or the IP of the server, trying them in combination with both port 636 and 3269, I get Error <0x51>: Fail to connect to DNSSrvr1.
Any ideas? I'm not quite sure where to go from here. I hate to go through the process of re-requesting the certificate if that isn't the issue.
Thank you, Christine
Solution: Setting up LDAPS on Windows 2008
For your subject CN, instead of the hostname use the FQDN. You don't want your DC cert to be exportable, but that shouldn't cause the issue - just a recommendation. You will want to get a "SAN" cert from GoDaddy and include the info from the last line in that - GoDaddy has them for under 100 bucks. You want the following info: server1.domain.local (same as subject - include this as first entry) ldap.domain.local server1 (if hostname is allowed by commercial CA) 192.168.0.1 (if IP address is public, or if internal IP is allowed by CA - uncommon)
Here's the .inf that we use here for our LDAP certs. To create CSR file run this from cmd certreq -new policy.inf YourServer.csr
If issuing from your own internal CA run this from cmd certreq -submit -config CASERVER.DNS.NAME\CAName YourServer.csr YourServer.cer
[Version] Signature="$Windows NT$"
[NewRequest] Subject="CN=DC1.YourDomain.local" ; enter FQDN here - must be FQDN not another name PrivateKeyArchive=FALSE Exportable=FALSE UserProtected=FALSE MachineKeySet=TRUE ProviderName="Microsoft RSA SChannel Cryptographic Provider" ProviderType=12 UseExistingKeySet=FALSE RequestType=PKCS10 KeyLength=2048 KeyUsage = 0xF0 ; Digital Signature, Key Encipherment, Nonrepudiation, Data Encipherment ; Alternative 0xA0 for DigSig & Key Encipher only KeySpec=1 SMIME=TRUE
[EnhancedKeyUsageExtension] OID=1.3.6.1.5.5.7.3.1 ; Server Authentication OID=1.3.6.1.5.5.7.3.2 ; Client Authentication ; OID=1.3.6.1.4.1.311.20.2.2 ; Smart Card Logon - include even if you don't use SC right now ; comment out if going to a commercial CA - include if internally issued
[RequestAttributes] ; CertificateTemplate = WebServer ;Change to appropriate template name or OID ;Omit line if CA is a stand-alone CA or commercial or other non-MS CA ; SAN = "dns=server1.domain.local&dns=server1&dns=ldap.domain.local&dns=server1&ipaddress=192.168.0.1" ; do not include if submitting to commercial CA - purchase a SAN cert and fill in during the appropriate step