From LDAP to LDAPS (LDAP + SSL enabled)

[Marco-IT]

Hi,

we're already using LDAP in order to access to Splunk, but now we need to "switch" to LDAPS.

I've read the port needs to be 636 and "SSL enabled" flagged, but the message "You must also have SSL enabled on your LDAP server" confuses me.

Should I do something else? Do I need to change .pem certificate? If so, on the cluster master?

i've found this conf file: $SPLUNK_HOME/etc/openldap/certs/ldap.conf, I guess I also need to modify it.

Thank you in advance for any help you can offer.

[isoutamo]

Hi

LDAP without TLS normally use port 389 on LDAP server side. And TLS enabled it usually is 636. Of course those could be something else.

As error message said when you check "Enable SSL" box it just switch TLS protocol to use, but it didn't change your LDAP server's port. Now it try to connect with TLS to port which aren't use TLS so it failed. You need to change you host's port on configuration to 636 to use your LDAP server's TLS port aka LDAPS.

If these two things (enable ssl + change port) didn't help, then you must contact your LDAP admin and ask in which port it is running LDAPS and/or is it supporting LDAPS.

r. Ismo

[Marco-IT]

Thank you @isoutamo for your answer!
So I understand I just need to change the port and flag the option "SSL enabled", right?

Nothing to do with the certificate? Is there a way to check what's the LDAP server from Splunk?

Marco

[isoutamo]

Exactly that way.

If/when you have already working LDAP connection from splunk without TLS, it's usually just change those two items to get it working with TLS. Of course it needs that port 636 has opened on all FWs between splunk and your ldap server.

[Marco-IT]

@isoutamo Great, and what about the new CA certificate I received? Where should I put it?

[isoutamo]

If your company is using private CA which are not known by your host you should ask that your server staff will add it as trust CAs on OS level.