LDAP connection does not work with SSL

Technical assistance
1

Infos:

A short info in advance. In our company, the colleague who set up the Zammad has left. For this reason, we unfortunately don’t have too much information yet.

  • Used Zammad version: 6.2.0-1704392455.bba4f84a.focal
  • Used Zammad installation type: (package)
  • Operating system: Ubuntu 20.04.6 LTS
  • Browser + version: Chrome up2date

Expected behavior:

  • The LDAP connection should work with SSL

Actual behavior:

  • Currently the Zammad server does not connect to the LDAP source, which is our DomainControler via SSL. We get the following error message. “Can’t connect to ‘192.168.200.15’ on port ‘636’, SSL_connect returned=1 errno=0 peeraddr=192.168.200.15:636 state=error: certificate verify failed (unable to get local issuer certificate)”

If SSL verification is set to no, the LDAP connection works.

Steps to reproduce the behavior:

We first checked whether the firewall is blocking the connection from the Zammad server to the DomainController. (it does not)
We have checked whether the connection via the shared port from the Zammad server to the DomainController works. (the port is open on the DC)
Port 636 on the DC is being listened to, the associated services have been started.
The DC is working, as is the ActiveDirectory. The user for the LDAP connection is active.

It is not entirely clear to us where the error is coming from. From our DomainController or the Zammad server. Do we have to store certificates that are required on the Zammad server and on the DomainController? If so, where are they located?

Perhaps one or the other can give us some food for thought.

Thank you very much

2

Hi raik,

you have to add the certificate of your (active directory integrated) Certificate Authority to the zammad certificate store (settings->security->ssl certificates)

i guess your domain controller uses a certificate from your internal ca. so you have to add the certificate of your ca to zammad. So zammad could verify the certificate of the active directory-server (DC).
The error: “certificate verify failed (unable to get local issuer certificate)” not a connect problem, but a unknown trust state.

2 Likes
3

Thank you very much. That was exactly the crucial hint we were missing.

I have now exported the certificate from our DC and imported it under the settings. LDAP synchronization via SSL is now working again.

4

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.