# LDAP certificate not valid for any names

**URL:** <https://discourse.openondemand.org/t/ldap-certificate-not-valid-for-any-names/2824>\
**Category:** Get Help\
**Created:** [July 21, 2023, 7:43pm UTC](https://discourse.openondemand.org/t/ldap-certificate-not-valid-for-any-names/2824 "2023-07-21T19:43:01Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![perrymil](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/perrymil/32/1620_2.png) [@perrymil](https://discourse.openondemand.org/u/perrymil)\
**Post date:** [July 21, 2023, 7:43pm UTC](https://discourse.openondemand.org/t/ldap-certificate-not-valid-for-any-names/2824/1 "2023-07-21T19:43:01Z")

</div>

Hi All,

##### Internal Server Error

Login error: failed to connect: LDAP Result Code 200 “Network Error”: x509: certificate is not valid for any names, but wanted to match ldap.acc.ohsu.edu

I got that message after configuring our cluster.yml file and restarting httpd and ondemand-dex.

Is this something to do with CA trust? I saw some mention of the tls cert configuration in the ood\_portal.yml file, but wasn’t sure if I needed to add anything beyond the ssl cert configuration:

ssl:

- ‘SSLCertificateFile “/etc/pki/tls/certs/openondemanddev.ohsu.edu.crt”’
- ‘SSLCertificateKeyFile “/etc/pki/tls/private/openondemanddev.ohsu.edu.key”’
- ‘SSLCertificateChainFile “/etc/pki/tls/certs/openondemanddev.ohsu.edu-chain.pem”’

Which appears to be working fine for the TLS cert in that it redirects to https fine, and shows a valid cert…

Jul 21 15:37:38 openondemanddev ondemand-dex[3561]: time=“2023-07-21T19:37:38Z” level=error msg=“Failed to login user: failed to connect: LDAP Result Code 200 "Network Error": x509: certificate is not valid for any names, but wanted to match ldap.acc.ohsu.edu”

Thoughts?

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [July 21, 2023, 7:59pm UTC](https://discourse.openondemand.org/t/ldap-certificate-not-valid-for-any-names/2824/2 "2023-07-21T19:59:11Z")

</div>

There’s some issue with the certificate that the LDAP server is providing I would guess.

You can see what the certificate looks like with this command.

```auto
openssl s_client -connect <host>:<port> -starttls ldap

```

Beyond that I think you’d need to ensure that the appropriate Certificate Authority files are on both machines (the ldap server and the OOD server).

---

<div class="post-metadata">

**Author:** ![perrymil](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/perrymil/32/1620_2.png) [@perrymil](https://discourse.openondemand.org/u/perrymil)\
**Post date:** [July 21, 2023, 10:24pm UTC](https://discourse.openondemand.org/t/ldap-certificate-not-valid-for-any-names/2824/3 "2023-07-21T22:24:27Z")

</div>

Thanks, we got that part resolved.

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [July 25, 2023, 6:13pm UTC](https://discourse.openondemand.org/t/ldap-certificate-not-valid-for-any-names/2824/4 "2023-07-25T18:13:57Z")

</div>

Thanks for the response! Please let us know what the resolution was in case someone else runs into the same.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/b/bae70bd0ed39a3ae769c2108155f4cb3e9da8385.png) [@system](https://discourse.openondemand.org/u/system)\
**Post date:** [January 21, 2024, 6:14pm UTC](https://discourse.openondemand.org/t/ldap-certificate-not-valid-for-any-names/2824/5 "2024-01-21T18:14:08Z")

</div>

Closed on January 21, 2024, 6:14pm UTC

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.