ODSEE - Directory Proxy Server (DPS) Fails To Connect To Directory Server (DS) With 'certificate_unknown' Error (Doc ID 1326577.1)

Last updated on JUNE 05, 2023

Applies to:

Symptoms

Directory Proxy Server (DPS) will not be able to connect with the backend Directory Server (DS) instances. The DS access log will show the following error.

[25/Sep/2009:11:37:12 +0200] conn=<nnn> op=-1 msgId=-1 - fd=23 slot=23 LDAPS connection from <IP_ADDR>:<NNN> to <IP_ADDR>
[25/Sep/2009:11:37:12 +0200] conn=<nnn> op=-1 msgId=-1 - SSL error -8101 (Certificate type not approved for application.); unauthenticated client E=<EMAIL>@<DOMAIN>,CN=<LDAP_PROXY,OU=<OU>,O=<SUFFIX_DN>,L=<LOCALE>,ST=<STATE>,C=<COUNTRY>; Issuer <ISSUER>
[25/Sep/2009:11:37:12 +0200] conn=<nnn> op=0 msgId=-1 - closing from <IP_ADDR>:<NNN> - B4 - Server failed to flush BER data back to client -
[25/Sep/2009:11:37:12 +0200] conn=<nnn> op=-1 msgId=-1 - closed.

and the DPS errors log displays:

[25/Sep/2009:11:37:12 +0200] - CONN - WARN - [Thread main] Unable to create a connection to LDAP server <HOSTNAME1>:<LDAPS_PORT>/Exception: Unable to perform SSL initialization on socket to <HOSTNAME2>:<LDAPS_PORT> -- javax.net.ssl.SSLHandshakeException: Received fatal alert: certificate_unknown

Changes

Cause

My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.