mc1903

1 Rookie

•

67 Posts

0

2524

December 30th, 2020 07:00

Attempting to configure LDAPS - "The certificate chain is not valid. (Error Code:0x6000947)"

Hi,

I am trying to configure a Unity VSA (5.0.5.0.5.002) to use LDAPS against two of my Windows 2019 DC's, as a test, and I am getting the error "The certificate chain is not valid. (Error Code:0x6000947)". I cannot find any directly helpful information for the specific error.

Dell Unity LDAPS - Certificate Chain Upload Error.png

I have other applications (vCenter Server, iDRAC) that are successfully authenticating against the same DC's via LDAPS, using the same certificate chain.

The certificate chain I am trying to upload is as follows (this is from an isolated lab environment) :

Questions:

1) What issue exactly does Error Code:0x6000947 allude to? As far as I can see the certificate chain is good; so is it a key size or signature/hash type issue? I am using the same root/intermediate CA pair to sign the Unity webserver certificate for the UI and that works just fine.

2) I have collected the Unity's 'Service Information', but once I untar it all, there are 100's of different log files. Is there a specific log file I should be looking at for LDAP configuration issues? Can I increase the level of logging in the short term to capture more detail?

3) My W2K19 DC's each present different certificates for LDAP; assuming I can fix the chain issue, can I upload multiple server certificate chains or does the Unity expect all LDAPS servers to use the SAME certificate chain?

Any help or advice will be appreciated.

Thanks,

M

Responses(6)

DELL-Josh Cr

Moderator

•

9.2K Posts

2

December 31st, 2020 06:00

Hi M,

When creating the certificate chain, do not use the server certificate itself. Only use the intermediate CA certificate(s) and the root certificate.

mc1903

1 Rookie

•

67 Posts

0

December 31st, 2020 07:00

Thank you @DELL-Josh Cr that has worked for me.

Dell Unity LDAPS - Verified - Working.png

Cheers

M

R

ravinderkodan88

1 Message

0

June 15th, 2022 06:00

Hi, I am getting same error. I have just uploaded root certificate, it is accepting the file but connection is getting failed. Tried to add CA certificate in-between but then it says incomplete chain.

Please assist.

DELL-Sam L

Moderator

•

7.5K Posts

0

June 15th, 2022 08:00

Hello ravinderkodan88,

Here are the links to a couple of kb’s that maybe of assistance.

https://dell.to/3b4DO6c

https://dell.to/3NUqyzn

GW

Gregory.Wille

2 Posts

0

September 7th, 2023 16:31

Steps
Ask Certificate Sysadmin for the site's Certificates for ..
Root.cer
Intermediate-CA.cer
ldap-server1.cer
ldap-server2.cer

Save the Certificates files on a host that has openssl installed (Linux or WSL), to do the testing.

Create ca-root-bundle certificate file
cp Intermediate-CA.cer ca-root-bundle.cer
cat Root.cer >> ca-root-bundle.ver

Verify the Intermediate-CA and Root Certificate Trusted chain, that created the ldap server Certificates
openssl verify -CAfile ca-root-bundle.cer ldap-server1.cer
openssl verify -CAfile ca-root-bundle.cer ldap-server2.cer

If both return ok
then
Update the "Distinguished Name" with the user name that will connect to the ldap server(s)
Enter the "Password" Use the Characters 0-9, a-z, A-Z, !#^*_-=+
Don't use these Linux Control characters for the password `()"@'$&/\
The "Verify Connection" will fail, as those characters will interfere with Windows GUI to Linux translation.
Select LDAPS Protocol to use port 636, (This requires the Trusted Intermediate-CA-Root-Bundle Certificate)
Select "Add" under Server Address, and Enter the LDAP server FQDN without the end dot or IP Address
Select "Upload Certificate" and Upload the ca-root-bundle.cer file
Select "Apply" the changes.
Select "Verify Connection"

Select "Close"

See Updated Del KB Article

Dell Unity: Error when trying to configure LDAPS: The certificate chain is not valid. (Error Code:0x6000947) (User Correctable)

https://www.dell.com/support/kbdoc/en-us/000081361

(edited)

GW

Gregory.Wille

2 Posts

0

September 7th, 2023 17:25

The Certificate chain above, has three Certificates
Extract them into three different certificates
The first certificate is ldap server as cert1-ldap.cer
The second certificate is ca server as cert2-ca.cer
The third certificate is root server as cert3-root.cer

By the way, check the certificate dates, as today is Sep 7, 2023, as they may have expired with the new 90 day rule.

$ openssl x509 -startdate -enddate -noout -in cert1-ldap.cer
notBefore=Dec 30 11:35:14 2020 GMT
notAfter=Dec 30 11:35:14 2021 GMT

$ openssl x509 -startdate -enddate -noout -in cert2-ca.cer
notBefore=Dec 30 10:49:23 2020 GMT
notAfter=Dec 30 10:59:23 2035 GMT

$ openssl x509 -startdate -enddate -noout -in cert3-root.cer
notBefore=Dec 29 22:31:40 2020 GMT
notAfter=Dec 29 22:41:37 2050 GMT

$ cp cert2-ca.cer ca-root-bundle.cer
$ cat cert3-root.cer >> ca-root-bundle.cer
$ openssl verify -CAfile ca-root-bundle.cer cert1-ldap.cer

CN = MC-ADDC-V-101.momusconsulting.com
error 10 at 0 depth lookup: certificate has expired
error cert1-ldap.cer: verification failed

$ date
Thu Sep 7 12:57:40 EDT 2023
$ sudo date --set='2021-02-02'
[sudo] password for user:
Wed Feb 2 00:00:00 EST 2021
$ openssl verify -CAfile ca-root-bundle.cer cert1-ldap.cer
cert1-ldap.cer: OK

NOTE: If the Date was still Feb 2 2021, this would work..
Select "Upload Certificate" and upload the ca-root-bundle.cer file

I hope that explains.

Thank you

View All

No Events found!

Unity

Attempting to configure LDAPS - "The certificate chain is not valid. (Error Code:0x6000947)"

Was this post helpful?