OID Ldapbind on SSL Port Fails With "SSL Handshake Failed" Error (NZerr 28862)
(Doc ID 3050774.1)
Last updated on OCTOBER 17, 2024
Applies to:
Oracle Internet Directory - Version 12.2.1.4.221222 and laterInformation in this document applies to any platform.
Symptoms
After configuring SSL Server Auth mode for OID, ldapbind command fails with "SSL handshake failed" error
SSL handshake failed
From oidldapd log
[OID] [TRACE:16] [] [OIDLDAPD] [host: xxxxxx] [pid: xxxx] [tid: xx] ServerListener : INFO : Accepted new connection conn id = 7, IpAddr=::ffff:xx.xx.xxx.x
[OID] [TRACE:16] [] [OIDLDAPD] [host: xxxxxx] [pid: xxxx] [tid: xx] ServerListener : INFO * Enqueue SSL connection SSLQ count = 1, conn id = 7, Source address: ::ffff:xx.xx.xxx.x
[OID] [TRACE:16] [] [OIDLDAPD] [host: xxxxxx] [pid: xxxx] [tid: xx] SSLthread: INFO * Dequeue SSL connection SSLQ count = 0, conn id = 7, Source address: ::ffff:xx.xx.xxx.x
[OID] [TRACE:16] [] [OIDLDAPD] [host: xxxxxx] [pid: xxxx] [tid: xx] SSLthread: TDP : SSL allocated memory is at 55a435e0 1824 bytes
[OID] [TRACE:16] [] [OIDLDAPD] [host: xxxxxx] [pid: xxxx] [tid: xx] SSLthread: TDP : SSL allocated memory is at 55a523e0 32 bytes
[OID] [TRACE:16] [] [OIDLDAPD] [host: xxxxxx] [pid: xxxx] [tid: xx] SSLthread: ERROR * gslsflnNegotiateSSL * SSL Hand Shake failed Source address: ::ffff:xx.xx.xxx.x * (NZerr 28862)
[OID] [TRACE:16] [] [OIDLDAPD] [host: xxxxxx] [pid: xxxx] [tid: xx] SSLthread: TDP : SSL Freeing memory is at 55a523e0 0 bytes
[OID] [TRACE:16] [] [OIDLDAPD] [host: xxxxxx] [pid: xxxx] [tid: xx] SSLthread: TDP : SSL Freeing memory is at 55a435e0 0 bytes
[OID] [TRACE:16] [] [OIDLDAPD] [host: xxxxxx] [pid: xxxx] [tid: xx] SSLthread: INFO : gslsfwsShutdownEndpoint : Cleanup of SSL state for connection
openssl command output
CONNECTED(00000003)
139650763073344:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:ssl/record/rec_layer_s3.c:1544:SSL alert number 40
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 338 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
"orapki display wallet" command output
$ orapki wallet display -wallet <Wallet_name>
Oracle PKI Tool Release 19.0.0.0.0 - Production
Version 19.4.0.0.0
Copyright (c) 2004, 2023, Oracle and/or its affiliates. All rights reserved.
Requested Certificates:
User Certificates:
Trusted Certificates:
Subject: CN=xxxxxx,DC=xxxx,DC=xxx
Subject: L=xxxxx,CN=xxxx,ST=xxxxxx,OU=xxxxx,O=xxxxx,C=xxxx
Subject: CN=<hostname>,OU=xxxx,O=xxxxxxx,L=xxxxxx,ST=xxxxx,C=xxxx ---------------> This is User Certificate, but shown under Trusted Certificate
Cause
To view full details, sign in with your My Oracle Support account. |
|
Don't have a My Oracle Support account? Click to get started! |
In this Document
Symptoms |
Cause |
Solution |
References |