I am using
.htaccess to ask for a username and passphrase which authenticates against LDAP.
The problem is, that the certificate is corrupt, and so Apache of course won't allow users to login.
As the LDAP server is managed by someone else, it can take days before the certificate is fixed.
If I try to connect to the AD using
Jxplorer I get
javax.naming.CommunicationException: simple bind failed: example.com:636 [Root exception is javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: Invalid Server Certificate: server certificate could not be verified, and the CA certificate is missing from the certificate chain. raw error: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target]
openssl s_client -showcerts -connect example.com:636
and parse the first certificate into
openssl x509 -text -in filename
Subject: is empty, which it shouldn't be to my understanding.
Is there a way to make Apache accept/ignore that the certificate is missing the Subject, so users can still authenticate to the website?
<Directory "/var/www/cgi-bin"> AllowOverride All Options None Order allow,deny Allow from all </Directory>
Order deny,allow Deny from All Options FollowSymLinks AuthName "Example" AuthType Basic AuthBasicProvider ldap AuthzLDAPLogLevel debug AuthLDAPBindDN "CN=example,OU=example,DC=example,DC=com" AuthLDAPBindPassword "xxx" AuthLDAPURL "ldaps://example.com/DC=example,DC=com?sAMAccountName?sub?(objectClass=user)" Require ldap-group CN=example,OU=example,DC=win,DC=example,DC=com AuthzLDAPAuthoritative on Satisfy any AuthUserFile /dev/null require valid-user