Error: "The LDAP connection is not secured" after replacing Active Directory certificate in vCenter
search cancel

Error: "The LDAP connection is not secured" after replacing Active Directory certificate in vCenter

book

Article ID: 446318

calendar_today

Updated On:

Products

VMware vCenter Server

Issue/Introduction

After replacing the SSL certificate on an Active Directory (AD) Domain Controller or Load Balancer, vCenter Single Sign-On (SSO) fails to connect or authenticate users. The vSphere Client reports the exact error: "The LDAP connection is not secured".

Environment

VMware vCenter Server (vSphere)
vCenter Single Sign-On (SSO)

Cause

vCenter SSO continues to cache the old Active Directory certificate. The trust mismatch between the old cached certificate and the newly installed AD certificate causes the secure LDAPS connection to fail. Replacing the vCenter machine SSL certificate does not automatically update the LDAP identity source trust.

Resolution

  1. Export the new public certificate (and its full trust chain) from the Active Directory Domain Controller or Load Balancer as a Base64-encoded .cer or .crt file.

  2. Log in to the vSphere Client using a local SSO administrator account (e.g., administrator@vsphere.local).

  3. Navigate to Administration > Single Sign On > Configuration.

  4. Select the Identity Sources tab.

  5. Select the Active Directory (over LDAP) identity source and click Edit.

  6. In the Certificates (for LDAPS) section, remove the old certificate(s) and upload the new .cer file.

  7. Click Save.

Workaround

If you receive a "Can't contact LDAP server" or "Failed to probe provider connectivity" error when saving the edit, the identity source must be re-created:

  1. Document all existing settings of the current Identity Source (Primary server URL, Base DN, domain name, etc.).

  2. Click Remove to delete the existing identity source.

  3. Click Add, select Active Directory over LDAP, and enter the identical configuration details.

  4. Upload the new certificate file in the Certificates (for LDAPS) section and complete the wizard.

Note: If the identity source is removed and re-added, you must re-add your AD groups to vCenter roles under Global Permissions if the previous mappings dropped. To avoid this, recreate the Identity Source with exactly the same name as the previous Identity Source.

 

Additional Information

Active Directory logins to vCenter fail (KB 418361)

Cannot configure identity source due to provider connectivity (KB 401134)

Powered by Wolken Software