Rancher LDAP AD Authentication to UCS Failure

[huwilerp]

Hello everyone,

I am having one heck of a time trying to allow Rancher. When attempting to connect via TLS port (636/7363) it states that the TLS cert cant be verified.

Error creating ssl connection: LDAP Result Code 200 “”: x509: certificate signed by unknown authority

https://rancher.com/docs/rancher/v2.x/en/admin-settings/authentication/ad/

I’ve read (How To: Created an UCS-CA signed certificate for a non-UCS system within Domain), but I am curious how that gets involved with the rancher LDAP authentication setup.

How To: Create an UCS-CA signed certificate for a non-UCS system within domain

Sometimes it’s neccessary to also create signed certificates for non-UCS systems in a domain. This also becomes more common and also more needed due to communication is often SSL encrypted nowadays. For such purposes UCS comes with a propriate command set which makes it easy to fullfil the task. The following command creates a signed certificate for the given server FQDN: root@ucs-master:~# univention-certificate new -name "another-server.$(dnsdomainname)" Creating certificate: another-server…

The above processes generated four certs, CAcert.crt, cert.pem, reg.pem, priavate.key.
Should I use the CAcert.crt in the upload, or should I be using the UCS servers cert?

Looking to see what I am doing wrong,

Please reference my attach photos.

[fbartels]

Hi @huwilerp,

the linked howto article is not really applicable in your case. On an ucs system everything is signed with its own ca to be fully trusted internally. But that also means that you need to import that ca on other systems that should interact with it.

This seems like it fits your case https://rancher.com/docs/rancher/v2.x/en/installation/options/custom-ca-root-certificate/