Problem when configure LDAPS

[BotFanTom]

Hello,

We have 2 sites with on each side a DC and a forti.

On a site A, we follow the following procedure to configure LDAPS : https://docs.fortinet.com/document/fortigate/5.4.0/cookbook/413849/configuring-ldap-over-ssl-with-wi...

The CA is on the DC of site A.

We export the CA certificate and it works well, client of site A authenticate on the DC with LDAPS.

We went the same configuration on the site B, but clients must authenticate on the DC of site B.

On the site B forti, we try to put the Name/Server IP of the DC of site A with the CA certificate and it works.

If I let the CA certificate but I change server configuration to link to DC of site B it don't works.

What is the solution to configure LDAPS but keep the authentication to the DC of site B ?

Thanks,

[Markus_M]

Hi Tom,

you can create a packet capture on port 636 and see what the certificate exchange gives you. The client, I understand is the FortiGate as such a TLS client and this will need to receive the server certificate and has to already have the CA certificate installed o the certificate management page. If there is an interim page it must be either sent by the server or installed in the FortiGate B as well.

Best regards,

Markus

[BotFanTom]

Hello,

I checked on wireshark the LDAP packets on port 636 and I noticed that when I don't check the certificate box with protocol LDAPS check, the forti manages to get my certificate from the domain controller of site B which is a certificate of model "Domain Controller" but not a CA.

So I don't understand what is the difference between an LDAPS configuration where we let the forti retrieve the domain controller certificate of the specified DC with the certificate box unchecked or the certificate box checked where we add the CA certificate and the server identity check.

Thanks,

[Markus_M]

Hi Tom,

The FortiGate will not retrieve a certificate.

The certificate checkbox will let you select the CA certificate that your LDAPS certificate was signed by. Like a filter: without the checkbox, FortiGate accepts anything, with the checkbox it accepts only what you selected.

The certificate you see in the PCAP will in either case be the same. The server certificate is sent by the server, normally along with all intermediate CA certificates.

The FortiGate has to have the rootCA imported.

The certificates are related to each other with a cryptographically unique and ideally unfakeable link. Incorrect certificates in this link, will cause the connection to fail.

The link will be like

server certificate > intermediate CA > rootCA

There may be no or more intermediates, but they are supposed to be sent by the server to the client (FGT). The FortiGate in turn is supposed to verify the sent info by completing the chain with the rootCA (imported to the store and selected in the checkbox as filter).

Hope this helps. If I may draw an analogue scenario:

HTTPS - The procedure is exactly the same. The server here is the webserver community.fortinet.com as example, the client is not the FortiGate, but your web browser.

Best regards,

Markus