Identity Synchronization for Windows: AD connector failure

Question

I've recently setup ISW in order to synchronize my primary AD domain and my newly installed directory server instance. The ISW core, connectors and plug-in installs are completed.
I ran the final idsync resync to populate directory server from AD and that ran successfully. I then ran an idsync startsync and saw that synchronization was started on all components of the system.
- The Synchronization, Configuration Directory, Message Bus and System Manager are all in the "Started" state.
- The AD (CNN101) and Directory Server (CNN100) directory sources are in the SYNCING state
idsync printstat output as follows:
Exploring status of connectors, please wait...
Connector ID: CNN100
Type: Sun Java(TM) System Directory
Manages: dc=domain,dc=com (ldaps://ldap1.domain.com:636) (ldaps://ldap2.domain.com:636)
State: SYNCING
Installed on: ldap1.domain.com
Plugin SUBC100 is installed on ldaps://ldap1.domain.com:636
Plugin SUBC101 is installed on ldaps://ldap2.domain.com:636
Connector ID: CNN101
Type: Active Directory
Manages: ne.domain.com (ldaps://london.ne.domain.com:636) (ldaps://winads02.ne.domain.com:636) (ldaps://winads03.ne.domain.com:636) (ldaps://winads04.ne.domain.com:636) (ldaps://winads05.ne.domain.com:636) (ldaps://winads01.ne.domain.com:636)
State: SYNCING
Installed on: linopsldp01.prod.domain.com
Sun Java(TM) System Message Queue Status: Started
Checking the System Manager status over the Sun Java(TM) System Message Queue.
System Manager Status: Started
SUCCESS
I then try to login to a linux client system to complete the on-demand password synchronization. However, when I do that I see the following in the directory server that is handling the request's error log:
[30/Sep/2009:16:51:49 -0400] - WARNING<38783> - isw - conn=17 op=1 msgId=3 - Plugins authentication cannot be completed, because no domain controller (ldaps://winads01.ne.domain.com:636 ldaps://london.ne.domain.com:636 ldaps://winads02.ne.domain.com:636 ldaps://winads03.ne.domain.com:636 ldaps://winads04.ne.domain.com:636 ldaps://winads05.ne.domain.com:636) is available to verify credentials for user uid=user,ou=people,dc=domain,dc=com
In the CNN100 logs I see the following error on both directory server plugin sub-components:
"DS Plugin (SUBC101): authentication to Active Directory server at ldaps://winads01.ne.domain.com:636 failed (bind DN: CN=iswadm,OU=Service Accounts,DC=ne,DC=domain,DC=com), error(81): Can't contact LDAP server"
I know that connectivity to the domain controller listed is fine and I can reach port 636 on that host from both directory servers. I don't understand how the connecters can be in the SYNCING state if there is no connectivity to them and I went through the entire setup previous to this with no issues. I've restarted the DS instances and ISW with no luck. Has anyone seen this sort of problem before? Any ideas on a fix/further troubleshooting would be greatly appreciated.

Answer 1

Thanks for the pointer to the SSL certificates. It turns out that some of the AD controllers were reporting expired certificates even though they had updated and valid certs. A reboot of those domain controllers fixed that issue.
I now have an issue in completing the on-demand password synchronization process when my client systems are pointed at the directory proxy server systems. I can complete the operation and login when the client is pointing directly at one of the directory servers:
[09/Oct/2009:00:58:12.584 -0400] INFO 40 CNN100 ldap01.prod.domain.com "DS Plugin (SUBC100): on-demand validation has been successfully completed for 'uid=user,ou=people,dc=domain,dc=com' by authenticating the user against ldaps://winads01.ne.domain.com:636"
Do I need to add some schema to the directory proxy servers or add some control for dspsqpassword/dspswvalidate operations? I'm looking through both DPS and DS logs now in hopes of finding something.
Any additional pointers are appreciated.