Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We use a central AD server for authentication, and have several different webapps that connect to it via LDAP.

I'm trying to connect a simple webapp running on Tomcat 5.5 on Windows to the AD server via secure ldap (ldaps), but have run into some issues importing the certificate (in this case, a ".cer" file).

All of the documentation I've found refer to importing SSL certs and configuring a connector so that Tomcat can serve HTTPS traffic. How does one import an SSL cert for LDAPS, and then reference the cert in the JDNI entry?

share|improve this question

I think the keyword you're missing for search purposes is the "cacerts" file which is manipulated using the Java keytool binary. In a java/tomcat environment, cacerts contains a list of Certificate Authority (CA) certificates that are trusted by default (similar to how OSes and web browsers have their own list of trusted CAs).

Your AD domain controller's certificate was likely generated by an internal CA. You need to import this CA certificate (or possibly chain of certificates) into the "cacerts" file that your Tomcat environment is using. Unless your domain controller's certificate is self-signed, you don't need to import its own certificate.

Once the cacerts file trusts the chain of CAs that generated your domain controller's certificate, you should be able to use LDAPS without issue.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.