Customer restarted webnetwork and now it won’t start. It gives errors like :
FATAL (12/23) 11:19:23 [com.stoneware.service.DirectoryManager]: Unable to verify/extend schema.
javax.naming.CommunicationException: simple bind failed: 192.168.1.41:636 [Root
exception is java.net.SocketException: Software caused connection abort: recv failed]
If you disable SSL in the 8090 directory servics tab then it starts up fine.
Customer also tried using LDP.exe and that also gave a 0x51 error and cound not connect.
This means that your AD SSL Certificate root CA server has expired on your MS CA server. When the CA server is installed, it creates a Root CA Certificate and that has a 2 year expiration.
Explanation of the microsoft certificate authority, how to install, how to renew, etc... http://technet.microsoft.com/en-us/library/bb727098.aspx
Some of the errors you will see in the Event Viewer that indicate your SSL certificate has expired.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 12/23/2010
Time: 6:55:33 PM
User: N/A
Computer: APP1
Description:
The Certificate Services service terminated with service-specific error 2148204801 (0x800B0101).
Event Type: Error
Event Source: CertSvc
Event Category: None
Event ID: 58
Date: 12/23/2010
Time: 7:19:54 PM
User: N/A
Computer: APP1
Description:
A certificate in the chain for CA certificate 0 for app1ca has expired. A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file. 0x800b0101 (-2146762495).
Event Type: Warning
Event Source: Schannel
Event Category: None
Event ID: 36872
Date: 12/23/2010
Time: 6:59:53 PM
User: N/A
Computer: APP1
Description:
No suitable default server credential exists on this system. This will prevent server applications that expect to make use of the system default credentials from accepting SSL connections. An example of such an application is the directory server. Applications that manage their own credentials, such as the internet information server, are not affected by this.
The following command can be run to validate the error code
J:>certutil -error 2148204801
0x800b0101 (-2146762495) -- 2148204801 (-2146762495)
Error message text: A required certificate is not within its validity period whe
n verifying against the current system clock or the timestamp in the signed file
.
CertUtil: -error command completed successfully.
To renew the ssl certificate, follow these instuctions, please refer to the following MS instructions for more indepth details : http://technet.microsoft.com/en-us/library/bb727098.aspx
Run mmc.exe
Click on File
Click Add/Remove Snapin
Click Add
Find Cerfiticate Authority
Choose local computer (if you are on the same server as the CA service)
Click Finish then Close then OK
Click + Certification Authority
You will probably see your server name with a red dot icon indicating the problem cert server.
Right-click the root node for the CA (Root CA), point to All Tasks, and then select Renew CA Certificate. This displays the Renew CA Certificate dialog box.
Right-click the root node again and in all tasks choose Start Service.
Now you should be able to run the certutil command with -cainfo and get back the proper results such as the example below :
J:>certutil -cainfo
Exit module count: 1
CA name: app1ca
Sanitized CA short name (DS name): app1ca
CA type: 0 -- Enterprise Root CA
ENUM_ENTERPRISE_ROOTCA -- 0
CA cert count: 2
KRA cert count: 0
KRA cert used count: 0
CA cert[0]: 4 -- Expired
CA cert[1]: 3 -- Valid
CA cert version[0]: 0 -- V0.0
CA cert version[1]: 0x10001 (65537) -- V1.1
CA cert verify status[0]: 0x800b0101 (-2146762495)
CA cert verify status[1]: 0
CRL[0]: 4 -- Expired
CRL[1]: 3 -- Valid
CRL Publish Status[1]: 5
CPF_BASE -- 1
CPF_COMPLETE -- 4
Delta CRL Publish Status[1]: 6
CPF_DELTA -- 2
CPF_COMPLETE -- 4
DNS Name: app1.stoneware.com
Advanced Server: 0
CertUtil: -CAInfo command completed successfully.
Each DC should be tested using the Microsoft
Ldp tool to verify that each DC has obtained a valid SSL Certificate. If you are unable to connect to a DC with ldp.exe then that DC should be restarted and retested. Any DC that fails with ldp.exe will cause problems for webNetwork.