AD LDS SSL does not work

[hflocken]

Hi,

I'm currently trying to get SSL on AD LDS on W2K8 R2 x64 up and running. I already have installed a certificate for the AD LDS service account. When I use LDP.EXE on the local system, I can get an SSL connection without any problem. When I use LDP.exe on a different W2K8 system, I can also get an SSL connection without any problems. So the certificate is ok and the connection to the system works as well.

However, I need to create an SSL connection from a W2K3 system to my AD LDS on W2K8. And this always fails. It also fails from a java application - the is the application that finally needs to access the AD LDS system.

I looked at the AD LDS event log and found the following error message:
Client network address:
192.168.105.10:4614
Protocol:
TCP

Additional Data
Error value:
2148074289 The client and server cannot communicate, because they do not possess a common algorithm.
Internal ID:
c050707


When I look at the data that Wireshark captures, I can see a SSL v2 Client Hello, but afterwards the server terminates the connection. The SSL v2 client hello contains a number of Ciphers, where at least some should be known by the AD LDS system.

When I look at the captured data from the W2K8 system where the connection works, I can see an SSL (not v2) handshake, that contains some more ciphers (e.g. with AES, which are not present in the client hello of the W2K3 system).

Can anybody give me hint what I need to do in order to be able to use SSL connections from the W2K3 system? Thanks a lot in advance!

Best regards
Holger

[Potawatomi]

It is possible to connect to the instances. For example, consider as a first step in ADSI Edit, if all necessary schema classes and attributes are present. For this one opens by right clicking on ADSI Edit > Connect to the naming context scheme. Important is to use the server name (if the local host) followed by a colon and the specified when setting up the appropriate port authority, in our example localhost: 10001 for a non SSL secured LDAP connection. The full LDAP path is therefore: LDAP: / / localhost: 10001/Schema. Refer the link for more detailed information.

Configuring LDAP over SSL Requirements for AD LDS