Grouper Users - Open Discussion List

[Liam Hoekenga <>]

I apologize.  I checked my logs, and you're right, the error predates the patches.

It looks like there were some recent changes that I was unaware of - the cert on the LDAP server /was/ changed on 1/25/18

My loader noticed and started complaining about on 1/26.  I guess I haven't been in this sandbox environment since that change.

That said, the CN on the cert does match the hostname, and the CA cert is the trustStore.  :\

2018-01-26 06:15:00,832: [DefaultQuartzScheduler_Worker-5] ERROR DefaultLdapFactory.create(109) -  - unabled to connect to the ldap

javax.naming.CommunicationException: simple bind failed: mcqa-vault2.dsc.umich.edu:636 [Root exception is javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: Hostname '[mcqa-vault2.dsc.umich.edu]' does not match the hostname in the server's certificate]

[liamr@grouper1 conf]$ openssl s_client -connect mcqa-vault2.dsc.umich.edu:636 -showcerts

CONNECTED(00000003)

depth=1 OU = Organizational CA, O = MCOMMUNITYQA

verify error:num=19:self signed certificate in certificate chain

---

Certificate chain

 0 s:/O=MCOMMUNITYQA/CN=mcqa-vault2.dsc.umich.edu

   i:/OU=Organizational CA/O=MCOMMUNITYQA

I guess I'll keep poking at it.

Liam

On Wed, Jan 31, 2018 at 2:06 PM, Hyzer, Chris <> wrote:

You could revert those two patches and see if you can connect, I have a feeling you wont be able to since its unrelated, but please let me know.

 

Was the cert changed recently or the java version or something?

 

Thanks

Chris

 

From: [mailto:] On Behalf Of Liam Hoekenga
Sent: Wednesday, January 31, 2018 3:02 PM
To:
Subject: [grouper-users] grouper subject engine LDAP cert errors

 

I just installed API patches 90 and 91, and now I can't connect to the LDAP server defined in my subject.properties. 

 

The logs say...

2018-01-31 14:40:51,016: [localhost-startStop-1] ERROR DefaultLdapFactory.create(109) -  - unabled to connect to the ldap

javax.naming.CommunicationException: simple bind failed: mcqa-vault2.dsc.umich.edu:636 [Root exception is javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: Hostname '[mcqa-vault2.dsc.umich.edu]' does not match the hostname in the server's certificate]

 

Seems straightforward enough... but...

I've checked the cert's CN using "openssl s_client", and it's a match.

I've verified that the CA cert for our institutional CA that signed the cert is in the javax.net.ssl.trustStore being used for Tomcat.

 

Any ideas?

 

Liam