/var/log/proton/policy-ui.log
, /var/log/syslog
and /var/log/proton/nsxapi.log
:"Error: Unable to obtain server certificate. Communication error. Verify that the IP address/hostname, port, and other parameters are correct. (Error code: 53000)."
nc -vz <ldaps-server> 636
The issue with the Check Status button returning a failure while LDAP authentication is still working is resolved in VMware NSX 4.2.0.
Workaround:
Ensure the LDAPS or LDAP with StartTLS server is using a supported, secure cipher suite as listed above.
If you believe you have encountered this issue and are unable to upgrade the LDAPS or LDAP with StartTLS server cipher suite at this time, please contact Broadcom Support and refer to this KB article.
Cipher suites now used by VMware NSX 4.1 and onwards:
Cipher suites used by previous versions of VMware NSX:
The below packet capture shows the client hello from VMware NSX manager sending the two cipher suites:
Note: [VMC on AWS] LDAPS may stop working after upgrading to SDDC version 1.22 (KB # 323284, Legacy KB # 94541) archived in favor of this article