How to Configure Secure LDAP (LDAPS) on Windows Server 2012

How to Configure Secure LDAP (LDAPS) on Windows Server 2012

[manjuever]

Ur a godsend. Even AI couldnt give me proper way of enabling this.

[nicolasdiazlozano]

This works to me in Windows 2019. Thanks

[bhimgrg]

Lol Like the Humor. 99 Years so that i don't have to do it. 😂 Thank you for the video

[vetribull]

Hi there, is there anyways to add printers under the LDAP in Windows Server 2016?. Your reply is very much appreciated

[madmaverick]

And that’s an example that could be replaced with the phrase. CA role installed on a DC automatically activates LDAPS.

However, that will NEVER HAPPEN on a real world scenario because of role separation.

[Progmium]

How would you go about dealing with an expired LDAP certificate?

[OthmanAlikhan]

Some the practices suggested are rather insecure, but thanks for the video anyhow, especially the restart part. Was fighting my domain controller =)

[DRSmetter]

This is a demo folks, I don't do it on a DC either. Just saving time by not having to spin up a separate VM!

[ramshukla]

Can we do setup user directoy in our local machine i.e. windows 10 operating system?

[SecuriTI]

Excelente amigo! Muchas gracias por tan excelente aporte!

[denismejanov]

It is always security concern to install PKI, never install CA on domain controllers (bad practice, bad manner even for the demonstration purpose.) Not disclosed the client access (different servers, domain members) to LDAP via secured port (required certificates on clients)

[kaverisingh]

Hi, I'm facing simple bind failed error, and I have installed the SSL certificates on webserver keystore, still not able to establish connection. Can you help me on this?

[Technicalturbo]

Great .. really good content and proper explanation in this video

[squirreljester]

Great video. I'm trying to find out if you can run a single DC with LDAPS but have the rest of your environment run on LDAP, or if LDAP and LDAPS can run in parallel so that regular LDAP continues to work but things that require LDAPS can authenticate that way?

[KJL]

I am attempting to integrate AD over LDAPS integration with an application, in order to do this I need to import the CA certificate into the JAVA trust keystore "cacerts" on the APP host. I can get a response on the actual DC using LDP.exe and I get ONE certificate when I use "openssl s_client -showcerts -connect HOSTNAME:636" on the client server. That being said I also get:


verify error:num=20:unable to get local issuer certificate

verify return:1

depth=0
verify error:num=27:certificate not trusted
verify return:1
depth=0
verify error:num=21:unable to verify the first certificate

I only get one cert so i import the certificate into the JAVA cacerts keystore using "keytool -import -alias LDAPS-HOSTNAME -keystore JAVAPATH\lib\security\cacerts -storepass changeit -file CAFILE.cer" this succeeds; however, when attempting to connect the client service to the LDAPS server I get:
Error executing command. Failure: 400 Bad Request. Server message: Failed to verify configuration ad: An SSL handshake error occurred while attempting to connect to LDAPS server: unable to find valid certification path to requested target.


I am not an expert at CA, in fact what I know I have learned through fumbling around with it and reading online forums. This is all for a lab environment/testing purposes so it doesn't really matter; however, i don't think this procedure generates what's needed for a client to access the DC through LDAPS.

[lEduS]

Hello, can you do a video on how to configure a client machine to connect to this server? I tried to install the certificate and use the same ldp.exe to connect but i cannot figure it out why the certificate is not recognized as a trusted certificate.

[phillipcox]

In a command prompt GPUpdate.exe /Force

Worked instead of a reboot for me.

[AmitThakorlovemeorhateme]

i want to have a separate server with just ldap role and connect that to the domain controller that has AD users..how to do connect separate ldap not integrated inside dc

[SebastianKaczorowski]

nope, it doesn't work like that... i can't connect to this port. It's not even listed as open when I run netstat

[charlespctech]

This video should be updated as SHA1 is no longer recommended and may be vulnerable to attack