Errror during SSL connection with LDAP using JNDI APIs

Question

Hello,
I have established a client and server certificates cert.arm for LDAP server and client. On client i have created a client.kdb file and on server server.kdb file both containing cert.arm. whwn i give a request
C:\Program Files\IBM\LDAP\bin>ldapsearch -b "o=ibm,c=us" -h 9.182.174.71 -p 636 -D cn=roo
-w root1 -Z -K "C:\Program Files\ibm\ldap\etc\client.kdb" -P client -s sub cn=s* cn sn
it gave me proper results
but using a JNDI API where i specify
Hashtable env = new Hashtable(11);
     env.put(Context.INITIAL_CONTEXT_FACTORY,
     "com.sun.jndi.ldap.LdapCtxFactory");
     // Specify LDAPS URL
     env.put(Context.PROVIDER_URL, "ldap://"+"9.182.174.71:636");
     // Authenticate as S. User and password "mysecret"
     env.put(Context.SECURITY_PROTOCOL, "ssl");
     env.put(Context.SECURITY_AUTHENTICATION, "simple");
     env.put(Context.SECURITY_PRINCIPAL, "cn=root1");
     env.put(Context.SECURITY_CREDENTIALS, "root1");
DirContext ctx = new InitialDirContext(env);
SearchControls constraintssc=new SearchControls();
constraintssc.setSearchScope(SearchControls.SUBTREE_SCOPE);
                         // performing the search
NamingEnumeration results=ctx.search("o=ibm,c=us","cn=s*",constraintssc);
////etc.........
Its gives me an exception saying that
javax.naming.CommunicationException: simple bind failed: 9.182.174.71:636. Root
exception is javax.net.ssl.SSLHandshakeException: Couldn't find trusted certificate
Could any body help me out on this
Thank You

Answer 1

You are attempting to authenticate via an SSL connection to port 636.
The message 'couldn't find trusted certificate' means that your client doesn't trust the certificate it has received from the LDAP server.
In order to establish that trust, you must export a certificate file from the LDAP server, then use Java's keytool.exe to create a keystore file using that certificate. Then your client code must reference that keystore file that you've created.
So essentially, you have to provide your program the LDAP server's credentials. "If the server's certificate looks like this, then you can trust it."
After your program trusts the certificate it receives from the server at runtime, your connection will authenticate.