I set out to integrate Active Directory with the iDRAC LOM for our Dell servers. One of the prerequisites is that the Domain Controllers be SSL enabled for ldap communication. The setup process in iDRAC says
Upload Active Directory CA Certificate. So I log in to one of our DCs, go to its personal certificate store, and it's empty. Up until today I've always assumed that our domain services were using SSL (I wasn't the one who set up the domain). I've never set it up before myself, and I'm not too familiar with the ins-and-outs, so the only way I know to check whether we're using SSL or not is to use wireshark on the DC and captures packets. Capturing on port 636 yielded nothing while capturing on 389 gave me all sorts of data. So at this point I'm pretty sure we're not using SSL.
So my question is, how important is it that the directory information that is transmitted back and forth be encrypted? I'm assuming that if there were an immediate risk over it not being encrypted no matter what your domain is like (whether the company is big or small with varying levels of security rules), that Microsoft would have just forced the SSL.
Obviously I would like to have AD integration with the LOM on my Dell servers, but I have some work to do before implementing it. A couple of questions I would like answers to are:
- What risks should I be aware of that we're facing by not using SSL
- If I follow one of the million guides on the internet to enable SSL, will it interrupt current service? Or will I be able to do it and the client machines will some how be informed to use SSL automatically?
- I have two DCs running a single domain as domain.local. Since it's an "internal" TLD, I'm guessing I'll need to set this up using an internal CA and not a third party?
- Based off the answer of #1, would you say it's safe to stay off of SSL? What would you feel is the ratio of benefit to effort involved in getting converted to ssl?