SYMPTOM:
When testing a connection to an LDAP server over SSL with Strategy Intelligence Server 9.x and 10.x, the following error message appears:
Sample Code/Error
Failure to initialize a LDAP session to server "XXXX".
This error message is also repeated in the DSSErrors.log. A test connection to the same server over cleartext connects successfully.
The following Strategy Knowledge Base technical notes have more information on configuring LDAP over SSL:
CAUSE:
One possible cause of this error message is the host specified in the Strategy Intelligence Server 9.x LDAP configuration does not match the Subject of the SSL certificate.
ACTION:
Ensure the host specified in the Strategy Intelligence Server 9.x and 10.x LDAP configuration matches the CN entry for the Subject of the SSL certificate being used.
For example, examine the following SSL certificate stub:
Sample Code/Error
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 0 (0x0)
Signature Algorithm: PKCS #1 MD5 With RSA Encryption
Issuer: E=CA@example.com, CN=CA, OU=Tech Services, O=Strategy, L=McLean, ST=Virginia, C=US
Validity:
Not Before: Wed May 30 21:45:16 2007
Not After: Fri Mar 19 21:45:16 2010
Subject: E=CA@example.com, CN=CA, OU=Tech Services, O=Strategy, L=McLean, ST=Virginia, C=US
In this example, the CN of the Subject is 'CA'. The host entry in the Strategy Intelligence Server 9.x LDAP configuration should be set to CA for the Strategy Intelligence Server 9.x to correctly identify and use the certificate.
If necessary, map the host name to the appropriate IP address in the machine's hosts file.
