Hi,

I have a problem with secure LDAP connection with Active Directory. Even though I have 

OCSPCheckExtensions=NO and CDPCheckExtensions=NO in qm.ini I can see from a packet capture that MQ tries to contact the Distribution points. When the request fails it just returns and error back to Active Directory and prints out  "'ldap_simple_bind' call returned error 81 : 'Can't contact LDAP server'.". Any idea how to fix this? For other SSL/TLS connections I cannot see the validation attempt.

------------------------------
--Hermanni
------------------------------

https://www-01.ibm.com/support/docview.wss?uid=swg1IT25430
Set the below in the qm.ini file and restart the queue manager.
AllowTLSV1=Y
in the SSL stanza of the qm.ini file.

------------------------------
Matthias Jungbauer
------------------------------

Hi Matthias, thanks for your reply. Unfortunately it didn't solve the issue. The error message that I receive is the same as described in technote, but I think the root cause is different. I can see from the packet capture that MQ tries to contact the CRL distribution points that it receives with the server certificate. My question is that why the same configuration that disables a CRL check done during the message channel SSL/TLS handshake doesn't disable the one that happens during LDAPS handshake?

--Hermanni

------------------------------
Hermanni Pernaa
------------------------------

Original Message:
Sent: Tue February 11, 2020 11:02 AM
From: Matthias Jungbauer
Subject: Secure LDAP and CRLDistributionPoint

https://www-01.ibm.com/support/docview.wss?uid=swg1IT25430
Set the below in the qm.ini file and restart the queue manager.
AllowTLSV1=Y
in the SSL stanza of the qm.ini file.

------------------------------
Matthias Jungbauer
------------------------------

Maybe it is best, if you ask IBM for an answer.

------------------------------
Matthias Jungbauer
------------------------------

Original Message:
Sent: Mon February 24, 2020 05:37 AM
From: Hermanni Pernaa
Subject: Secure LDAP and CRLDistributionPoint

Hi Matthias, thanks for your reply. Unfortunately it didn't solve the issue. The error message that I receive is the same as described in technote, but I think the root cause is different. I can see from the packet capture that MQ tries to contact the CRL distribution points that it receives with the server certificate. My question is that why the same configuration that disables a CRL check done during the message channel SSL/TLS handshake doesn't disable the one that happens during LDAPS handshake?

--Hermanni

------------------------------
Hermanni Pernaa
------------------------------


Original Message:
Sent: Tue February 11, 2020 11:02 AM
From: Matthias Jungbauer
Subject: Secure LDAP and CRLDistributionPoint

https://www-01.ibm.com/support/docview.wss?uid=swg1IT25430
Set the below in the qm.ini file and restart the queue manager.
AllowTLSV1=Y
in the SSL stanza of the qm.ini file.

------------------------------
Matthias Jungbauer

Di​d you ever resolved this issue, If so, can you share how?

------------------------------
Afaque Khan
------------------------------

Original Message:
Sent: Mon February 24, 2020 05:37 AM
From: Hermanni Pernaa
Subject: Secure LDAP and CRLDistributionPoint

Hi Matthias, thanks for your reply. Unfortunately it didn't solve the issue. The error message that I receive is the same as described in technote, but I think the root cause is different. I can see from the packet capture that MQ tries to contact the CRL distribution points that it receives with the server certificate. My question is that why the same configuration that disables a CRL check done during the message channel SSL/TLS handshake doesn't disable the one that happens during LDAPS handshake?

--Hermanni

------------------------------
Hermanni Pernaa
------------------------------


Original Message:
Sent: Tue February 11, 2020 11:02 AM
From: Matthias Jungbauer
Subject: Secure LDAP and CRLDistributionPoint

https://www-01.ibm.com/support/docview.wss?uid=swg1IT25430
Set the below in the qm.ini file and restart the queue manager.
AllowTLSV1=Y
in the SSL stanza of the qm.ini file.

------------------------------
Matthias Jungbauer

Hi,
yes, I was able to solve the issue. The problem was caused by a missing intermediate certificate.
The certificate chain has to be complete in order to make LDAPS connectivity to work.
Hope this helps.

------------------------------
Hermanni Pernaa
------------------------------

Original Message:
Sent: Thu April 16, 2020 12:59 PM
From: Afaque Khan
Subject: Secure LDAP and CRLDistributionPoint

Di​d you ever resolved this issue, If so, can you share how?

------------------------------
Afaque Khan
------------------------------


Original Message:
Sent: Mon February 24, 2020 05:37 AM
From: Hermanni Pernaa
Subject: Secure LDAP and CRLDistributionPoint

Hi Matthias, thanks for your reply. Unfortunately it didn't solve the issue. The error message that I receive is the same as described in technote, but I think the root cause is different. I can see from the packet capture that MQ tries to contact the CRL distribution points that it receives with the server certificate. My question is that why the same configuration that disables a CRL check done during the message channel SSL/TLS handshake doesn't disable the one that happens during LDAPS handshake?

--Hermanni

------------------------------
Hermanni Pernaa


Original Message:
Sent: Tue February 11, 2020 11:02 AM
From: Matthias Jungbauer
Subject: Secure LDAP and CRLDistributionPoint

https://www-01.ibm.com/support/docview.wss?uid=swg1IT25430
Set the below in the qm.ini file and restart the queue manager.
AllowTLSV1=Y
in the SSL stanza of the qm.ini file.

------------------------------
Matthias Jungbauer

Thanks
That helps. 


------------------------------
Afaque Khan
------------------------------

Original Message:
Sent: Mon April 20, 2020 01:41 AM
From: Hermanni Pernaa
Subject: Secure LDAP and CRLDistributionPoint

Hi,
yes, I was able to solve the issue. The problem was caused by a missing intermediate certificate.
The certificate chain has to be complete in order to make LDAPS connectivity to work.
Hope this helps.

------------------------------
Hermanni Pernaa
------------------------------


Original Message:
Sent: Thu April 16, 2020 12:59 PM
From: Afaque Khan
Subject: Secure LDAP and CRLDistributionPoint

Di​d you ever resolved this issue, If so, can you share how?

------------------------------
Afaque Khan


Original Message:
Sent: Mon February 24, 2020 05:37 AM
From: Hermanni Pernaa
Subject: Secure LDAP and CRLDistributionPoint

Hi Matthias, thanks for your reply. Unfortunately it didn't solve the issue. The error message that I receive is the same as described in technote, but I think the root cause is different. I can see from the packet capture that MQ tries to contact the CRL distribution points that it receives with the server certificate. My question is that why the same configuration that disables a CRL check done during the message channel SSL/TLS handshake doesn't disable the one that happens during LDAPS handshake?

--Hermanni

------------------------------
Hermanni Pernaa


Original Message:
Sent: Tue February 11, 2020 11:02 AM
From: Matthias Jungbauer
Subject: Secure LDAP and CRLDistributionPoint

https://www-01.ibm.com/support/docview.wss?uid=swg1IT25430
Set the below in the qm.ini file and restart the queue manager.
AllowTLSV1=Y
in the SSL stanza of the qm.ini file.

------------------------------
Matthias Jungbauer