LDAP test connection failed - Cannot use secure connection

Products

CA Release Automation - Release Operations Center (Nolio) CA Release Automation - DataManagement Server (Nolio)

Issue/Introduction

LDAP test connection is failing with error "Cannot use secure connection. Check that the server certification is configured correctly" :

In nolio_dm_all*.log there is following error :

2025-06-26T03:58:35.355+01:00 [CaAuthenticationManager$$Lambda$641/252859976-1164] DEBUG (com.nolio.platform.server.dataservices.services.auth.CaAuthenticationManager:101) - Checking LDAP/AD Connectivity
2025-06-26T03:58:35.355+01:00 [CaAuthenticationManager$$Lambda$641/252859976-1164] DEBUG (com.nolio.platform.server.dataservices.services.SecuritySystemPropertiesConfigure:109) - ********* BEFORE DEFAULT METHOD trustStore : conf/nolio.jks
2025-06-26T03:58:35.355+01:00 [CaAuthenticationManager$$Lambda$641/252859976-1164] DEBUG (com.nolio.platform.server.dataservices.services.SecuritySystemPropertiesConfigure:117) - ********* AFTER DEFAULT METHOD trustStore : conf/nolio.jks
2025-06-26T03:58:35.683+01:00 [CaAuthenticationManager$$Lambda$641/252859976-1164] ERROR (com.nolio.platform.server.dataservices.services.auth.providers.NolioActiveDirectoryAuthenticationProvider:62) - Found a NON working system user [U: <LDAP>, DC: <LDAP_DC>]. Disabling Active Directory integration (for this domain)!!!
org.springframework.ldap.CommunicationException: simple bind failed: <LDAP NAME>:636; nested exception is javax.naming.CommunicationException: simple bind failed: <LDAP_NAME>:636 [Root exception is javax.net.ssl.SSLHandshakeException: No subject alternative DNS name matching <LDAP_NAME> found.]
    at org.springframework.ldap.support.LdapUtils.convertLdapException(LdapUtils.java:108) ~[spring-ldap-core-2.3.8.RELEASE.jar:2.3.8.RELEASE]
    at com.nolio.platform.server.dataservices.services.auth.providers.ExtensibleActiveDirectoryAuthenticationProvider.bindAsUser(ExtensibleActiveDirectoryAuthenticationProvider.java:156) ~[ra-business-logic-services-6.9.0.jar:?]
    at com.nolio.platform.server.dataservices.services.auth.providers.NolioActiveDirectoryAuthenticationProvider.init(NolioActiveDirectoryAuthenticationProvider.java:51) ~[ra-business-logic-services-6.9.0.jar:?]
    at com.nolio.platform.server.dataservices.services.auth.CaAuthenticationManager.lambda$enableDisableAuthenticationProvider$3(CaAuthenticationManager.java:103) ~[ra-business-logic-services-6.9.0.jar:?]
    at java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1384) ~[?:1.8.0_332]
    at java.util.stream.ReferencePipeline$Head.forEach(ReferencePipeline.java:647) ~[?:1.8.0_332]
    at com.nolio.platform.server.dataservices.services.auth.CaAuthenticationManager.lambda$init$0(CaAuthenticationManager.java:81) ~[ra-business-logic-services-6.9.0.jar:?]

Environment

Release Automation 6.8, 6.9
NAC on Windows

Cause

This problem could occur when following conditions are met :

- LDAP/AD server is configured with SSL certificates (LDAPS)
- Nolio RA is configured to point to a server alias of LDAP/AD - not the actual/physical server
- LDAP/AD certificate do not contain the alias in the Subject Alternative Name list

Resolution

There are 2 possible solutions :

- Update the LDAP certificate to include the alias in the Subject Alternative Name list

or

- set the JRE option to "Disable Endpoint Identification on Windows"

Stop NAC service "Nolio Release Automation Service"
Open regedit and export following registry key to do a backup :

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Apache Software Foundation\Procrun 2.0\NolioServer20
Go in registry key
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Apache Software Foundation\Procrun 2.0\NolioServer20\Parameters\Java

Doble click on Options key and add this string at the end of the list :
-Dcom.sun.jndi.ldap.object.disableEndpointIdentification=true
Click OK and Start NAC service "Nolio Release Automation Service"

Additional Information

See this article for more information : Can not log into ROC 6.7 (also on 6.8) after upgrade