Trying to verify a LDAP over SSL certificate, Server cannot be reached-CodePudding

I'm currently trying to connect to a LDAPS Server using the following VB.NET Code, which should set the right parameters and use the function seen below to verify the certificate when the Bind function is called.

The value of LdapHost is the IP, 10.100.11.10, and the value for LdapPort is 7636.

connection = new LdapConnection(new LdapDirectoryIdentifier(LdapHost, LdapPort));
connection.AuthType = 2; // Negotiate
connection.SessionOptions.SecureSocketLayer = true;

connection.SessionOptions.VerifyServerCertificate = new VerifyServerCertificateCallback(VerifyServerCertificate);

//Both username and password are correct
connection.Credential = new System.Net.NetworkCredential(strUsername, strPassword); 
connection.Bind();

This, But upon trying to verify the Server Certificate, using the following code:

private bool VerifyServerCertificate(LdapConnection ldapConnection, X509Certificate certificate)
{
    try
    {
        X509Certificate2 certificate2 = new X509Certificate2(certificate);
        return certificate2.Verify();
    }
    catch (Exception ex)
    {
        throw new LdapException(9999, "Invalid certificate or path.");
    }
}

It Errors out at the Bind function saying that it cannot connect to the LDAP Server at all with the message "The LDAP Server cannot be reached" Although upon testing the connection via PowerShell, the Server is available just fine.

Is there something wrong with my verification method? Should I try a different approach entirely?

CodePudding user response：

I have found the reason why the verification did not work. Using

 X509Chain chain = new X509Chain();

 X509Certificate2 certificate2 = new X509Certificate2(certificate);
 var chainBuilt = chain.Build(certificate2);
 LogEvent("Val", 0, "Chain building status: "   chainBuilt);
 if (chainBuilt == false) {
     foreach (X509ChainStatus chainStatus in chain.ChainStatus)
         LogEvent("Val", 0, "Chain error: "   chainStatus.Status   " "   chainStatus.StatusInformation);
     chain.Reset();
     return false;
 }  else  {
     chain.Reset();
     return true;
  }

if the verification fails helped me understand that the Root Certificate was not trusted on that specific server. Furthermore, it told me that it could not reach the Revokation Server to check if the Certificate is still valid.

This couldn't be checked though, since the configuration uses a StartTLS certificate, which does not have a Revokation Server.

Therefore, I added

chain.ChainPolicy.VerificationFlags = X509VerificationFlags.IgnoreRootRevocationUnknown | X509VerificationFlags.IgnoreEndRevocationUnknown | X509VerificationFlags.IgnoreCtlSignerRevocationUnknown;

to ignore every property regarding the Revokation Server. It can now connect as intended.