Security

Reply
Occasional Contributor II
Posts: 23
Registered: ‎09-03-2013

Clearpass LDAPS to self signed AD

I'm having trouble authenticating against an AD server that has a self signed CA.  I was able to import the cert, but I still fail.   I see an "unknown CA" error during the TLS negotiation between the Clearpass and AD server.

 

Is this a non-starter with Clearpass?   And...before everyone flags the security (or lack thereof) of using a self signed cert....we're testing prior to going in production with a true cert.

MVP
Posts: 4,301
Registered: ‎07-20-2011

Re: Clearpass LDAPS to self signed AD

You have to export the cert and install it on your laptop since the laptop doesn't have the root ca
Thank you

Victor Fabian
Lead Mobility Engineer @ Integration Partners
AMFX | ACMX | ACDX | ACCX | CWAP | CWDP | CWNA
Aruba
Posts: 1,377
Registered: ‎12-12-2011

Re: Clearpass LDAPS to self signed AD

You also need the ad root cert in clearpass's trust list
Seth R. Fiermonti
Consulting Systems Engineer - ACCX, ACDX, ACMX
Email: seth@hpe.com
-----
If you found my post helpful, please give kudos
Guru Elite
Posts: 8,633
Registered: ‎09-08-2010

Re: Clearpass LDAPS to self signed AD

[ Edited ]

This is solely between ClearPass and AD. You don't need to do anything to clients.

 

Since it is a self-signed certificate, upload the AD certificate here:

 

ceritifcate-trust-list.PNG

 

If its signed by an internal MS ADCS certificate authority, upload the private root CA.


Tim Cappalli | Aruba Security TME
@timcappalli | timcappalli.me | ACMX #367 / ACCX #480
Occasional Contributor II
Posts: 23
Registered: ‎09-03-2013

Re: Clearpass LDAPS to self signed AD

Thanks Tim.

I have limited access to the server, so I uploaded the cert they said the LDAP server is using in the trust list...it's enabled and trusted.

I still throw an unknown CA error in a wireshark trace, so that means I was given the wrong cert...or I have a mismatch between cert and dns name.

 

Search Airheads
Showing results for 
Search instead for 
Did you mean: