不適切な証明書によるサイト検出中のsecd.ldap.noServers:EMERGENCY
環境
- ONTAP 9
- サイト検出
- Domain Controller（DC;ドメイン コントローラ）
- Lightweight Directory Authentication Protocol Secure（LDAPS）
- 証明書
問題
secd.conn.auth.failuresecd.ldap.noServersはイベントログで確認されます。
[node_name: secd: secd.conn.auth.failure:notice]: Vserver (vserver_name) could not authenticate over the network to server (dc_server_name). Error: Can't contact LDAP server (Service: LDAP (Active Directory), Operation: SiteDiscovery).
[node_name: secd: secd.ldap.noServers:EMERGENCY]: None of the LDAP servers configured for Vserver (vserver_name) are currently accessible via the network for LDAP service type (Service: LDAP (Active Directory), Operation: SiteDiscovery).
- SVMでLDAPSが有効になっている
- DCサーバとの通信は成功しますが、
SECD.logで確認された証明書ハンドシェイク中にエラーが発生します。
[kern_secd:info:15263] | [000.005.771] debug: Connection type LDAP (Active Directory) translated to LIF service = 99 { in getLifService() at src/connection_manager/secd_connection_shim.cpp:278 }
[kern_secd:info:15263] | [000.005.780] debug: CM_STATS: Tracking connect() to server 10.99.99.1, port 636 { in startConnectTracking() at src/cm/secd_cm_stats_manager.cpp:885 }
[kern_secd:info:15263] | [000.005.993] info : Successfully connected to ip 10.99.99.1, port 636 using TCP { in _connect() at src/connection_manager/secd_connection_shim.cpp:555 }
[kern_secd:info:15263] | [000.013.579] debug: LDAP TLS Alert generated is 'fatal:unsupported certificate'
[kern_secd:info:15263] | [000.013.705] debug: ldap_sasl_bind_s returned -1 { in ldapSaslBindSpnego() at src/connection_manager/secd_connection.cpp:854 }
[kern_secd:info:15263] | [000.013.727] ERR : Additional Error Message: error:0A000086:SSL routines::certificate verify failed (unsuitable certificate purpose) { in ldapSaslBindSpnego() at src/connection_manager/secd_connection.cpp:860 }
[kern_secd:info:15263] | [000.013.734] ERR : RESULT_ERROR_LDAPSERVER_SERVER_DOWN:7642 in ldapSaslBindSpnego() at src/connection_manager/secd_connection.cpp:864
[kern_secd:info:15263] | [000.013.741] ERR : ldapSaslBindSpnego: LDAP Error: (-1): 'Can't contact LDAP server':
[kern_secd:info:15263] | [000.014.185] ERR : RESULT_ERROR_LDAPSERVER_SERVER_DOWN:7642 in ldapSaslBind() at src/connection_manager/secd_connection.cpp:1098