How to use LDAP/ADSI Server with a Secure Connection (TLS)
When using a secure connection (TLS) to your domain controller for LDAP or ADSI user authentication there are a few things to need to be configured for this to work propery.
1. Make sure that port 636 is allowed through both the server local firewall settings and your cloud configuration (Azure,AWS, etc.)
2. Verify on your domain controller that it is listening on port 636
PS> Test-NetConnection localhost -Port 636
This should return TcpTestSucceeded : True
3. Determine your FQDN for your domain contoller
PS> "$env:COMPUTERNAME.$env:USERDNSDOMAIN"
4. Make sure your domain controller has a TLS certificate configured
PS> Get-ChildItem Cert:\LocalMachine\My |
Format-List Subject,DnsNameList,EnhancedKeyUsageList,HasPrivateKey,NotAfter,Thumbprint
You want to see a server certificate that can be used for Authentication
If you do not currently have one you can get a certificate for your domain controller from various certificate providers. You can also create a self signed certificate.
5. Optionally create a self signed certificate on your domain controller
$dcFqdn = "$env:COMPUTERNAME.$env:USERDNSDOMAIN"
$cert = New-SelfSignedCertificate `
-Type Custom `
-Subject "CN=$dcFqdn" `
-DnsName $dcFqdn `
-CertStoreLocation "Cert:\LocalMachine\My" `
-Provider "Microsoft Software Key Storage Provider" `
-KeyAlgorithm RSA `
-KeyLength 2048 `
-HashAlgorithm SHA256 `
-KeyExportPolicy Exportable `
-KeyUsage DigitalSignature,KeyEncipherment `
-NotAfter (Get-Date).AddYears(5) `
-TextExtension @(
"2.5.29.37={text}1.3.6.1.5.5.7.3.1"
$rootStore = New-Object System.Security.Cryptography.X509Certificates.X509Store( "Root", "LocalMachine")$rootStore.Open("ReadWrite")$rootStore.Add($cert)$rootStore.Close()
6. If your domain controller uses a self signed certificate then you need to add this certificate (just the public key portion) to the server that is running Titan SFTP Server. Import the certificate into the Trusted Root Certification Authorities store on the machine running Titan SFTP Server
7. When configuring the LDAP Connection in Titan SFTP be sure to use the FQDN in the "Server Name" field on the LDAP authentication wizard