Member Avatar for bornie21

Hie all
I am trying to setup Ldap over SSL using the Windows Ldp utility on a Windows 2008 R2 domain controller which is also the Enterprise root CA. When I try to bind securely using the IP address(192.168.0.2) I get the following error:"The certificate received from the remote server does not contain the expected name. It is therefore not possible to determine whether we are connecting to the correct server. The server name we were expecting is 192.168.0.2. The SSL connection request has failed. The attached data contains the server certificate." However when I use the computers full name MTC-DC.domainname I bind securely. I am a newbie to Microsoft Certificates and all.
Any help please

  • 3 Contributors
  • 3 Replies
  • 516 Views
  • 38 Minutes Discussion Span
  • Latest Post Latest Post by CimmerianX

Dani AI

Generated

The behavior described is expected: the TLS client checks the name you used to connect against the names on the server certificate. As noted, Ldp works when you use the server’s FQDN because that name is on the cert; connecting by IP fails because 192.168.0.2 is not in the certificate. As pointed out, a client also must trust your CA — PHP often needs extra configuration to do that.

Checklist and concrete steps to resolve (server + PHP):

  • Verify the server certificate: open the DC’s certificate (Local Computer → Personal) and confirm the certificate’s Subject and Subject Alternative Name include the FQDN (DNS name = MTC-DC.domainname). Ensure the cert has Server Authentication EKU and the private key is present. If you must connect by IP, the cert must contain an iPAddress SAN (not recommended; DNS/FQDN is preferred).

  • Ensure the client (the PHP host) trusts the CA chain. On Windows/IIS import the root CA into LocalMachine → Trusted Root Certification Authorities. On Linux add the root CA to the system store (e.g. /etc/ssl/certs) and run update-ca-certificates, and/or point OpenLDAP at the CA via /etc/ldap/ldap.conf (TLS_CACERT/TLS_CACERTDIR) or php.ini openssl.cafile.

  • Use an FQDN and the LDAPS scheme in PHP and set LDAP options before bind. Example:

    $ldap = ldap_connect("ldaps://MTC-DC.domainname:636");
ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, 3);
ldap_set_option($ldap, LDAP_OPT_REFERRALS, 0);
$ok = @ldap_bind($ldap, $bindDn, $password); // check ldap_error($ldap) on failure

  • Troubleshooting: from the PHP host run an SSL handshake check to see what the server presents and whether the chain validates:

    openssl s_client -connect MTC-DC.domainname:636 -showcerts
# look for Subject/subjectAltName and "Verify return code: 0 (ok)"

    Also capture ldap_error()/ldap_errno() after a failed bind.

These steps build on and ’s observations: name match + trusting the CA resolve almost all LDAPS vs PHP binding issues. If the cert and trust chain are correct and PHP still fails, check which LDAP library PHP uses (Win32 vs OpenLDAP) and configure that library’s CA settings.

Recommended Answers

All 3 Replies

Member Avatar for JorgeM

It sounds like that you used the computer's name in the subject line if the cert which is fine. Therefore, connecting via the host name produces the results as expected. If you connect via any other name rather than what is in the cert will produce warnings/errors. I don't see an issue here.

Member Avatar for bornie21

the thing is I am trying to connect via php and from there its not binding even when I use the full computer name.

Member Avatar for CimmerianX

Unless I'm missing something.... It doesn't matter what tool you are using, ultimately, you are still trying to establish a secure ldap session using the fqdn on the cert.

A few things to remember, you need to trust the root CA (your CA Server). If your php solution doesn't take this into account, you will get warnings.

Also, the php solution must use the name on the cert. IP addresses or netbios names will not work.

commented: thanks for the reply. Apart from compiling PHP with ldap enabled on Apache is there something that I am supposed to do +0
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.