SSL certifacate request from DCO and upload

[DCIM_Support]

Hello

In continue to my post regarding to connect from DCO to Active Directory via port 636 (https://community.ecostruxureit.com/questions/143756065/dco-connect-to-active-directory-via-ssl) the answer didn’t work to me .

I have old server (version 8.0.2) where that connection via port 636 to AD is working now .

After compare the configuration I have note that certificate of the DCO WEB in old server signed  via CA of the origination  .

Unfortunately I haven’t find exactly instruction into help tech info :

https://sxwhelpcenter.ecostruxureit.com/display/public/UADCO8x/Working+with+SSL+certificates

https://sxwhelpcenter.ecostruxureit.com/display/public/UADCO8x/Changing+SSL+certificate+on+the+serve...

How I can run certificate request and after it signed upload DCO ?

Is this process will be resolve the my problem ?

(CID:144313811)

[DCIM_Support]

Hi Boris,

If I understand correctly, you have a DCO 8.2.7 setup integrated with AD server (as authentication server). And the integration works fine using port 389, but if you change it to port 639, then you have issue, right?

If yes, then make sure that the AD server supports encrypted communications (using port 639). 

You might also want to try in web-client, Setup (top right, wheel icon) > Certificates page, delete the certificates (including the possible expired ones) for that specific AD server in DCO, and then try to configure the integration to use port 636 and see if that helps.

By the way/just in case, if your user profile language (web-client, user profile (top right) > Language) is not English, change it to English and then retry the AD configuration editing/changes.

Additional test: if you remove the integrated AD server (from DCO), and then added, would that help?

Note: take a fresh backup before doing any major changes/tests.

PS: DCO is shipped with self-signed certificate, this page https://sxwhelpcenter.ecostruxureit.com/display/public/UADCO8x/Changing+SSL+certificate+on+the+serve... you are referring to, contains the instructions if you want to use your own certificates! 

Kind regards

(CID:144313875)

[DCIM_Support]

Hello Jef

The first of all you are right . In additional  this a new server with version 8.2.7 and old server is working properly (8.0.2) with AD via port 636 .

I have run check with command

open-ssl s_client -connect ipADserver:636 -CApath /etc/ssl/certs

I see in old and new server all chunk CA , but in end I got the follow:

Verify return error code : 20(unable to get local issuer certificate) .

Although the error code old server is working.

I have remove all authentications server and created again only one , but receive the same result .

How I can to debug this issue ?

The customer is working in DCE via port 636 properly too .

(CID:144313907)

[DCIM_Support]

I have compared openssl s_client command and it’s same .

Is there any configuration into DCO that will be set ?

(CID:144313943)

[DCIM_Support]

Hi Boris,

I don't use the openssl test, so not sure what to expect from it. As you know already, the following instructions:

 https://sxwhelpcenter.ecostruxureit.com/display/UADCO8x/Setup+an+AD+%28Active+Directory%29+Server

is the only way to configure the integration.

I don't think there are configurations that may need to be reset (in DCO). Without detail investigations it is hard to say what might be the issue with your setup.  However, the product security have been improved in later versions (compared to previous releases). I would recommend testing this AD integration on the latest 8.3 release, if you/customer should experience the same issue, then it would be great if I could have the following data:

screen captures illustrating the authentication server settings/configurations in DCO

screen capture of the displayed errors

complete server logs

I will send you an invite to my =S= box shortly, so the data safely can be shared with me (when/if you would), thanks. 

Kind regards

(CID:144867446)

[DCIM_Support]

Many thanks Jef

in next week I attempt to send the relevant logs

(CID:144867522)

[DCIM_Support]

Hello Jef

On Sunday I'll go to customer for this issue .

Can you provide to me what is log file I need to upload exactly ?

(CID:144869270)

[DCIM_Support]

Hi Boris,

Log files (in DCO 8.2.7) can be collected from server webmin interface, StuxureWare DC Operation > Download Log Files > Download log files

please also include the time/date you've tried & seeing the issue (that helps us to search in the logs), thanks.

Kind regards

(CID:145424843)

[DCIM_Support · Accepted solution]

Hello

The problem has been solved .

Important point the filed of the host into configuration of the Authentication Server will be same (but exactly ) such like to  certificate .

I suggest add this point to guide  

(CID:146278246)

[DCIM_Support]

Hi Boris,

Can you please clarify this, possibly add some screen captures, thanks.

Kind regards

(CID:146278253)

[DCIM_Support]

(CID:146669723)

[DCIM_Support]

Hi Boris,

Thanks. That's correct, Host filed should contain either the IP address or the qualified host name.

Kind regards 

(CID:146669797)

[DCIM_Support]

This question is closed for comments. You're welcome to start a new topic if you have further comments on this issue.