Microsoft Active Directory LDAP – SSL Guide

Microsoft Active Directory (AD) Lightweight Directory Access Protocol (LDAP) server system does not include an easy GUI method to create a CSR.

The following guide includes typical recommendations for you to successfully enroll and implement an SSL certificate pfx file needed for your AD LDAP. Applies To: Windows Server 2008, Windows Server 2008 R2, Windows Server 2012.

The typical procedure is as follows.

1. Generate the CSR for your SSL certificate from one of the following methods.
   • If you have a server system that has Windows Internet Information Services Manager IIS.
     • CSR generation instructions for IIS 7 – 7.5 systems.
     • CSR generation instructions for IIS 8 -8.5 systems.
   • Generate the CSR using Portecle Keypair creation and manipulation tool.
2. After the SSL certificate has been issued you will have to install it and its intermediate back on the system or application you used to generate the CSR from step 1.
   • Install your SSL certificate  back into the Windows Internet Information Services Manager IIS.
     • Install your SSL certificate back into your IIS 7 -7.5 system (Performing Steps 1-2).
     • Install your SSL certficate back into your IIS 8 – 8.5 system (Performing Steps 1-2.).
   • Install your SSL certficate using Portecle Keypair creation and manipulation tool.
3. You will then Export and move the SSL Certificate with its private key as a .pfx off that system or application where your SSL certificate was installed.
   • Export the SSL certificate with its private key as a .pfx file from the IIS system you used
   • Export the SSL certificate from Portecle.
4. Now that you now have your .pfx file you will then move and import your SSL certificate .pfx into you AD-LDAP system from the steps below.

How to import your SSL .pfx  certificate into your LDAP system:
On your LDAP system you will Open and create a MMC Snap-In.

1. Start > run > MMC.
   
2. Go into the Console Tab > File > Add/Remove Snap-in.
3. Click on Add > Click on Certificates and click on Add.
   
4. In the Certificates snap-in window select Service account.
5. Click Next.
   
   
6. In the Select Computer window select Local computer:the computer this console is running on).
7. Click Next.
   
   
8. In the Certificates snap-in window select Active Directory Domain Services.
9. Click Finish.
   
   
10. Back in the Add or Remove snap-ins window click OK.
    
11. In the Certificates snap-in window, select Active Directory Domain Services and then, click Finish.
    Note: If you do not see Active Directory Domain Services as a option you will have to contact Microsoft for support. Click here.
12. In the MMC Console expand Certificates – Service (Active Directory Domain Services).
13. Right click on NTDS/Personal.
14. Select Import.
    
    
15. In the Certificate Import Wizard, click Next.
    
16. On the File to Import page, click Browse.
17. Specify the location and path of your SSL Certificate .pfx file, click Open.
    Note: You may have to change the file type to all in order to find your .pfx file.
18. Click Next.
    
    
19. On the password window specify the password that is associated with your .pfx file when you created it.
20. Check Mark this key as exportable…
21. Check Include all extended properties.
22. Click Next.
    
23. On the Certificates Storage window leave the default selected and click Next.
    
    
24. Click Finish.

Your client systems should now be configured to your Domain Controllers.

Verifying your SSL certificate is configured successfully:

1. Open the LDP console by performing a search for “LDP” run as an admin.
2. In the User Account Control window, click Yes to allow the program to make changes to the computer.
3. In Ldp, click Connection > Connect.
   
4. In the Connect window specify the following.
   1. Server: The hostname you are wanting to connect to.
   2. Port: specify the port of the hostname you wich to connect (636).
5. Check SSL.
6. Uncheck Connectionless.
7. Click OK.
   
8. You should receive a command output of the user name and the domain name for the binding.
9. If you receive a message stating Cannot open connection message, then this means LDAP-over-SSL binding is not configured properly.
10. Click OK.
    
11. Back in LDP window, click Connection > Bind.
    
12. In the Bind window, click OK.
    
13. The command output should display the user name and the domain name for the binding.

Your SSL certificate should now be installed on your LDAP system.

If you are unable to use these instructions for your server, Acmetek recommends that you contact either the vendor of your software or an organization that supports it.

Microsoft Support

For more information refer to Microsoft.