メインコンテンツまでスキップ

SSL/TLS原因secd.ldap.noServersの有効期限が切れた証明書

Views:
486
Visibility:
Public
Votes:
0
Category:
ontap-9
Specialty:
nas
Last Updated:

環境

  • ONTAP
  • サードパーティの LDAP サーバ
  • SSL/TLS

問題

  • 既存のLDAP設定でSSL/TLSを有効にすると 、LDAPサーバへの接続に失敗したためにストレージへのアクセスが影響を受ける可能性があります
  • EMS ログ:

secd.ldap.noServers: None of the LDAP servers configured for Vserver (VS1) are currently accessible via the network for LDAP service type (Service: LDAP (Active Directory), Operation: SiteDiscovery).

secd.ldap.noServers: None of the LDAP servers configured for Vserver (VS1) are currently accessible via the network for LDAP service type (Service: LDAP (Active Directory), Operation: MapNetbiosDomainToADDomain).

  • SecDログ:
 error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed
 RESULT_ERROR_LDAPSERVER_SERVER_DOWN:7642
 LDAP TLS Alert generated is 'fatal:decrypt error'
 error:0407006A:rsa routines:RSA_padding_check_PKCS1_type_1:block type is not 01
 RESULT_ERROR_LDAPSERVER_CONNECT_ERROR:7652 

secd: secd.unexpectedFailure:debug]: vserver (VSERVER) Unexpected failure.
Error: Get DC Info procedure failed CIFS Domain Query via LSAR_DS_ROLE_GET_DOMAIN_INFO - Client Ip = X.X.X.X
User = DOMAIN\USER   ...    
[   236] Successfully connected to ip X.X.X.X, port 389 using TCP  
[   377] Unable to start TLS: Connect error  
[   377]   Additional info: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed (certificate has expired)  
...

  • SecDログエントリには、想定される 証明書の件名が含まれます。

00000013.0022c89e 01eab99b Mon Apr 06 2020 14:31:44 +01:00 [kern_secd:info:14641] | [000.499.972]  info :  Required certificate with <CANAME> is not installed { in VerifyCertificateRevocationViaOSCP() at src/connection_manager/secd_connection.cpp:1667 }

  • 有効期限は、CLIコマンドで有効期限を示します。  ::> security certificate show
  • パケットトレースは、クライアントによって提供された完全な証明書チェーンを示すことができる

LDAPサーバの例:2つの証明書で構成される証明書チェーン

  • 1つは、ホスト自体の証明書(LDAPserverhostname発行者CAによって発行されたもの)です。
  • その他、 中間証明書(ルートCAによって発行された発行者CA

Transport Layer Security
    TLSv1.2 Record Layer: Handshake Protocol: Multiple Handshake Messages
        Content Type: Handshake (22)
        Version: TLS 1.2 (0x0303)
        Length: 2911
        Handshake Protocol: Server Hello
        Handshake Protocol: Certificate
            Handshake Type: Certificate (11)
            Length: 2587
            Certificates Length: 2584
            Certificates (2584 bytes)
                Certificate Length: 1208
                Certificate: 308204b43082039ca0030201020213160000802cf3c5747b… (id-at-commonName=LDAPserverhostname)
                    signedCertificate
                        version: v3 (2)
                        serialNumber: 0x160000802cf3c5747b5475eb2100000000802c
                        signature (sha256WithRSAEncryption)
                       issuer: rdnSequence (0)
                            rdnSequence: 3 items (id-at-commonName=Issuer CA )

                        validity
                        subject: rdnSequence (0)
                        subjectPublicKeyInfo
                        extensions: 9 items
                    algorithmIdentifier (sha256WithRSAEncryption)
                    Padding: 0
                    encrypted: d403151937a2904d0405e5fe7be043a51969650e43cc27e0…
                Certificate Length: 1370
               Certificate: 308205563082033ea00302010211114500000002578509d7… (id-at-commonName=Issuer CA )
                    signedCertificate
                        version: v3 (2)
                        serialNumber: 0x4500000002578509d77c523cae000000000002
                        signature (sha256WithRSAEncryption)
                       issuer: rdnSequence (0)
                            rdnSequence: 3 items (id-at-commonName=Root CA)

  • この例では 、のルート証明書 Root CA がインストールされている必要があります。

 

Sign in to view the entire content of this KB article.

New to NetApp?

Learn more about our award-winning Support

NetApp provides no representations or warranties regarding the accuracy or reliability or serviceability of any information or recommendations provided in this publication or with respect to any results that may be obtained by the use of the information or observance of any recommendations provided herein. The information in this document is distributed AS IS and the use of this information or the implementation of any recommendations or techniques herein is a customer's responsibility and depends on the customer's ability to evaluate and integrate them into the customer's operational environment. This document and the information contained herein may be used solely in connection with the NetApp products discussed in this document.