ARTIFACTORY: How to troubleshoot LDAPS connections in artifactory

Introduction 

LDAPS connection might fail with a message “error connecting to the LDAP server” with no clear error to trace after even with debug logger turned on.
In this article, we will cover how to troubleshoot this. 


Troubleshoot  

First, it’s recommended to have ldapserach client installed to test connections with your ldap server. You will need your manager's DN credentials

ldapsearch -x -H ldaps://ldap.example.com -b "dc=example,dc=com" -D "cn=admin,dc=example,dc=com" -W "(uid=someuser)"

If you get this error with LDAPS:
ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)

That error means your client cannot establish a secure (encrypted) network connection to the LDAP server. 
Next, check if the connection is blocked:

telnet your-ldap-server.com 636

If telnet is blocked, it is likely a certificate issue. Let’s check ssl verification:

openssl s_client -connect your-ldap-server.com:636

If you see a verification error, it means either the client server does not trust the ldap server’s certificate, or there is something wrong with the certificate.
Try connecting to the server trusting the ca who signs the certificate.

LDAPTLS_CACERT=/home/user/certs/ca.crt ldapsearch -x -H ldaps://ldap.example.com -b "dc=example,dc=com" -D "cn=admin,dc=example,dc=com" -W "(uid=someuser)"

Or ignore ssl verification with the following command:

LDAPTLS_REQCERT=never ldapsearch -x -H ldaps://ldap.example.com -b "dc=example,dc=com" -D "cn=admin,dc=example,dc=com" -W "(uid=someuser)"

To resolve this, you will need to trust the certificate and ca following this. 

If the trusted folder does not work. Try directly importing the root ca and intermediate certificates to java keystore:

sudo /opt/jfrog/artifactory/app/third-party/java/bin
/keytool -importcert -keystore /opt/jfrog/artifactory/app/third-party/java/lib/security/cacerts -storepass changeit -file ~/path/root.crt -alias "ldaps"

Then restart artifactory. 

Please note that for docker or kubernetes installation, /opt/jfrog/artifactory/app is often not persisted. 

Copy the cacerts to a persisted location and change the location of java keystore using javaOpts in system.yaml:

extraJavaOpts: "-Djavax.net.ssl.trustStore=/var/opt/jfrog/artifactory/cacerts -Djavax.net.ssl.trustStorePassword=changeit"

If this still does not resolve the issue, please reach out to jfrog support.