I am trying to join vCenter server 7.0.2 to AD over LDAP, however getting error "Can't contact LDAP server."
As a part of troubleshooting, it came out that vCenter cannot fetch the SSL certificates from the domain controllers and openssl gives following error:
root@myvcsa01 [ ~ ]# /usr/bin/openssl s_client -connect mydc01.domain.com:636
no peer certificate available
No client certificate CA names sent
SSL handshake has read 0 bytes and written 215 bytes
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
No ALPN negotiated
Protocol : TLSv1.2
Cipher : 0000
Key-Arg : None
PSK identity: None
PSK identity hint: None
SRP username: None
Start Time: 1636711093
Timeout : 300 (sec)
Verify return code: 0 (ok)
- All required ports are open between the vCenter and domain controllers and there's no traffic blocked.
So any idea on this? Where the problem is and how to fix it?
The port is typically 389 for LDAP connections and 636 for LDAPS connections.
Use the same command with port 389 and check. Engage you AD/DC/Firewall Team to see what's they see when you run the command.