LDAPS或LDAP+StartTLS连接因缺少CA证书而失败

• ONTAP
• LDAP服务器
• SSL/TLS协议

• 在现有LDAP配置上启用SSL/TLS后、 EMS中将开始显示以下消息

secd.ldap.noServers: None of the LDAP servers configured for Vserver (VS1) are currently accessible via the network for LDAP service type (Service: LDAP (Active Directory), Operation: SiteDiscovery).

secd.ldap.noServers: None of the LDAP servers configured for Vserver (VS1) are currently accessible via the network for LDAP service type (Service: LDAP (Active Directory), Operation: MapNetbiosDomainToADDomain).

• SECD日志包含 以下某些条目

  [    74] Successfully connected to ip x.x.x.x, port 389 using TCP
[    87] Required certificate with CA ClientAccessRootCA is not installed
[    87] Unable to start TLS: Connect error
[    87]   Additional info: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed (unable to get local issuer certificate)

• 验证  用于对LDAP服务器提供的证书进行签名的CA证书是否已安装在ONTAP中
• 数据包跟踪可以显示客户端提供的完整证书链
  • 一个是主机本身的证书(由 颁发者CA颁发的ldapserverhostname)，
  • 其他， 中间证书(由 根CA颁发的颁发者CA)

Transport Layer Security
    TLSv1.2 Record Layer: Handshake Protocol: Multiple Handshake Messages
        Content Type: Handshake (22)
        Version: TLS 1.2 (0x0303)
        Length: 2911
        Handshake Protocol: Server Hello
        Handshake Protocol: Certificate
            Handshake Type: Certificate (11)
            Length: 2587
            Certificates Length: 2584
            Certificates (2584 bytes)
                Certificate Length: 1208
                Certificate: 308204b43082039ca0030201020213160000802cf3c5747b… (id-at-commonName=LDAPserverhostname)
                    signedCertificate
                        version: v3 (2)
                        serialNumber: 0x160000802cf3c5747b5475eb2100000000802c
                        signature (sha256WithRSAEncryption)
                       issuer: rdnSequence (0)
                            rdnSequence: 3 items (id-at-commonName=Issuer CA )
                        validity
                        subject: rdnSequence (0)
                        subjectPublicKeyInfo
                        extensions: 9 items
                    algorithmIdentifier (sha256WithRSAEncryption)
                    Padding: 0
                    encrypted: d403151937a2904d0405e5fe7be043a51969650e43cc27e0…
                Certificate Length: 1370
               Certificate: 308205563082033ea00302010211114500000002578509d7… (id-at-commonName=Issuer CA )
                    signedCertificate
                        version: v3 (2)
                        serialNumber: 0x4500000002578509d77c523cae000000000002
                        signature (sha256WithRSAEncryption)
                       issuer: rdnSequence (0)
                            rdnSequence: 3 items (id-at-commonName=Root CA)