Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are accessing Active Directory through LDAP over SSL through Java on Windows Server 2003.

We have the properly authenticated certificate installed however another certificate has appeared on the machine from another service automatically.

We have removed the second certificate once and a new one was created.

The problem is, when we try to access AD through SSL the server presents the second certificate first rather than the certificate that we want. Is there a way to specify which certificate that AD uses?

I'm aware of the following from the Microsoft site but do not know how to get around it:

Multiple SSL certificates Schannel, the Microsoft SSL provider, selects the first valid certificate that it finds in the local computer store. If there are multiple valid certificates available in the local computer store, Schannel may not select the correct certificate.

share|improve this question

What OS version is this? I assume you are talking about LDAP over SSL when you say "accessing AD over SSL through Java".

If you have 2k8 or above, you can put the LDAP certificate in the NTDS\MY store and it will ensure that LDAP picks that one versus certificates that match the machine in the LocalMachine\MY store.

Take a look at if you need details.

share|improve this answer
Thanks. Yes, LDAP over SSL. We are on Windows 2003. – Tom Hubbard Jul 2 '10 at 9:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.