[VB .Net][LDAPS] Use of expired certificate

[Benoit Baranne]

Hi,

I'm trying to connect an eDirectory directory through VB .Net by using
DirectoryServices. I use the DirectoryEntry object to bind the server
but I've a problem when I try to use secure connection (LDAPS).

Actually, the server certificate is unknown and might be expired but I
would like to trust it anyway.

The only connection that I can have is an anonymous one, all the others
are refused. The error message that comes is "Server is down" (or
something like this in english, I translate from french...)

What I would expect is an option that, once set, will ask the user, for
example, to trust the certificate that is unknown or expired, as we can
see it on web browser when we try to access a securized web site that
provides an unknown certificate.

Have you any idea of how can I fix my problem?

Thx

Benoit

[Joe Kaplan (MVP - ADSI)]

Sorry, it doesn't work this way. With a web browser, the user is given a
warning when there is a problem with the certificate on the server such as
expiration, name mismatch, trust chain problem or revocation.

With .NET HTTP code (HttpWebRequest), it is possible to configure a custom
certificate policy to ignore certain errors and problems.

However, in similar LDAP code, any problem with the certificate will result
in a failure.

You really really need to get the server certificate fixed to get this to
work.

In order to help you troubleshoot though, you can enable schannel logging on
the client. That will give you more detailed answers as to what the
specific problem is (via System event log).

http://support.microsoft.com/?id=260729

Joe K.

"Benoit Baranne" <benoit....@gmail.com> wrote in message
news:1126193073....@z14g2000cwz.googlegroups.com...

[Benoit Baranne]

Thank you for you quick answer Joe.

Well, it is a pity, for me, that in LDAP code any problem with the
certification chain will result in a failure.
I already have a look to the system logs and, a schannel error is
actually logged...

BTW, I've installed the certificate on the client (as trusted
certificate), now, the only problem with it is a name mismatch. I hoped
that it would be enough, but... no.

Is there any possibility, that in the future DirectoryServices API
(presently I use the one that VS2003 provides) would have custom
certificate policy like those we can found in HttpWebRequest?

Well, thank you again Joe.

Benoit

Joe Kaplan (MVP - ADSI) a écrit :

[Joe Kaplan (MVP - ADSI)]

I believe you have so control over this if you you the lower level API,
System.DirectoryServices.Protocols, in .NET 2.0, but I'm not sure. I
haven't messed with those particular pieces. I know there is no support to
supply custom certificate policy in S.DS in .NET 2.0.

You might be able to get around the issue with the name mismatch for now
with a hosts file entry. This is a classic trick.

Joe K.

"Benoit Baranne" <benoit....@gmail.com> wrote in message

news:1126249069....@g43g2000cwa.googlegroups.com...

[Benoit Baranne]

You say :

"You might be able to get around the issue with the name mismatch for
now
with a hosts file entry. This is a classic trick."

I don't really understand this classic trick, could you tell me more
please.

[Joe Kaplan (MVP - ADSI)]

Sure, just go to your local hosts file (system32\drivers\etc) and add an
entry that maps the IP address of the server to the DNS name on the
certificate.

That should allow you to use the certificate's DNS name to get to the
server, while still getting to the correct IP address.

Joe K.

"Benoit Baranne" <benoit....@gmail.com> wrote in message

news:1126273267.1...@g49g2000cwa.googlegroups.com...

[Benoit Baranne]

Thank you very much! It works.

BB

Joe Kaplan (MVP - ADSI) a écrit :

> Sure, just go to your local hosts file (system32\drivers\etc) and add an