Open Directory is not providing a secure connection

I've been setting up Yosemite Server, but I haven't been able to get a second Mac to join onto the Open Directory service. When clicking Join… in Accounts Preferences on the client machine, and entering the address, it asks me whether I want to trust the server's certificates, which I do; and then, in a second dialog, it says "This server does not provide a secure (SSL) connection. Do you want to continue?"
My question, simply, is how do I confirm that my server is providing a secure Open Directory connection? If it's not, how do I enable it, and if it is, how do I convince my client to use it?
Background:
After doing the initial setup, I turned on Open Directory before noticing that the host name was not correct—I had not changed it from "Xxx.local". So I changed it to the correct domain as pointed to by an external DNS server. It mentioned that I'd have to reconfigure a number of services, Open Directory among them. I turned Open Directory off, then on, and confirmed in the Certificates section that all services were using the newly-generated certificate with the correct domain name. I turned on Profile Manager, and added a test network user, and an encrypted-only (SMB3) share for its home folder. For good measure, I turned on the Websites service.
At several points along this process, I tried to get the client to join the server's Open Directory, each and every time with the same message that the server does not provide a secure connection. I removed the applicable certificates on the client and tried again, just to be sure it wasn't using an outdated version of them—to no avail. The error is exactly the same whether I use the global .com hostname, the .local hostname, the global IP, or the local 10.0.1.x IP.
The server is running Mac OS X 10.10.1, and the client MBP is on 10.10.
The client is currently on the local network, but I aim to use Portable Home Directories and sync from other locations, so an unsecured OD connection is obviously unacceptable.
Any advice would be dearly appreciated!

First, follow the instructions in this support article to configure the clients to use the server's certificate to bind via LDAPS. The common name in the certificate must match both the server's hostname and its domain name, as resolved by the clients. You will get nowhere if those conditions aren't met.

Similar Messages

  • Cannot open page Safari cannot open the page because it could not establish a secure connection to the server

    Hello Apple Experts!!
    I Am Surendra and very new to this forum.. I just came across a problem with my Iphone while connecting to my company WIFI.. we are using Web authentication.. meaning..
    The user will try to connect to the wireless network, the client will get the IP address and they are forced to open up the browser to provide the USERNAME and the PASSWORD on the webpage, once they pass the auth they will be able to access to the internet.
    The WEB PAGE that asks for the USERNAME and the PASSWORD is HTTPS and for some reason that page is not at all opening and i am getting the below error.. If i disable HTTPS on the cisco Device the IPHONE works great..
    Cannot open page Safari cannot open the page because it could not establish a secure connection to the server
    This is happening only on the OS 5 and on the OS 4 everything works just great!!
    I have a feeling that this has to do something to do with HTTPS / SSL connection with the IPHONE SAFARI or OS 5
    Am connecting to Cisco Wireless LAN COntroller and the access point acting as the WIFI devices..
    Any help on the same will be much appreciated!!
    Regards
    Surendra

    I'm having a similar issue.  Connecting on my iPad FROM ANYWHERE to my work's domain results in the message by the OP.
    I checked the ciphers enabled by their page, and this was returned:
      High Strength Ciphers (>= 112-bit key)
        SSLv3
          EDH-RSA-DES-CBC3-SHA       Kx=DH         Au=RSA     Enc=3DES(168)    Mac=SHA1  
          DES-CBC3-SHA               Kx=RSA        Au=RSA     Enc=3DES(168)    Mac=SHA1  
          RC4-MD5                    Kx=RSA        Au=RSA     Enc=RC4(128)     Mac=MD5   
          RC4-SHA                    Kx=RSA        Au=RSA     Enc=RC4(128)     Mac=SHA1  
        TLSv1
          EDH-RSA-DES-CBC3-SHA       Kx=DH         Au=RSA     Enc=3DES(168)    Mac=SHA1  
          DHE-RSA-AES128-SHA         Kx=DH         Au=RSA     Enc=AES(128)     Mac=SHA1  
          DHE-RSA-AES256-SHA         Kx=DH         Au=RSA     Enc=AES(256)     Mac=SHA1  
          n/a                        Kx=DH         Au=RSA     Enc=Camellia(128)  Mac=SHA1  
          n/a                        Kx=DH         Au=RSA     Enc=Camellia(256)  Mac=SHA1  
          DES-CBC3-SHA               Kx=RSA        Au=RSA     Enc=3DES(168)    Mac=SHA1  
          AES128-SHA                 Kx=RSA        Au=RSA     Enc=AES(128)     Mac=SHA1  
          AES256-SHA                 Kx=RSA        Au=RSA     Enc=AES(256)     Mac=SHA1  
          n/a                        Kx=RSA        Au=RSA     Enc=Camellia(128)  Mac=SHA1  
          n/a                        Kx=RSA        Au=RSA     Enc=Camellia(256)  Mac=SHA1  
          RC4-MD5                    Kx=RSA        Au=RSA     Enc=RC4(128)     Mac=MD5   
          RC4-SHA                    Kx=RSA        Au=RSA     Enc=RC4(128)     Mac=SHA1  
    This appeared to be a more than sufficient cipher list, yet my iPad won't load any page.  I highly doubt it's a problem with SSL2 not being enabled because SSL2 has been deprecated for awhile now.
    Any ideas?

  • Hotspot login cannot open the page because it could not establish a secure connection to the server.

    I am trying to connect to a public wifi network.  My iPad connects marvoulesly.  My iPhone not so much.  I have an iPhone 4 and everytime I go to connect, it goes to a pop up page where I'm supposed to click a link to adhere to their TOS.  When I get the pop up page I get "Hotspot login cannot open the page because it could not establish a secure connection to the server"
    I've reset the network settings and nothing changed.  Same error message.  Any tips or tricks to fix this?  I'm laid up on bed rest in the hospital and would really rather that I not use all my data minutes...
    Thanks!

    Updated to iOS6 on an iPhone 4 this morning, and now when I attempt to connect to my work wireless, it connects for a moment then attempts to popup some login page (I sometimes get the hotspot login error you've mentioned) and because the page doesn't exist I can't get connected to the wireless netowrk.
    What the heck have apple broken in this update?
    Why when joining a normal wireless network is my phone even going near a Login page? What is this and how do I disable it?
    Oh, and I'm posting here because your suggestions of disabling the Wi-Fi and Cellular data netowkrs doesn't solve the problem.
    [Edit: seems while typing this leaving the cellular data disabled, it's now letting my join wireless - seems to be some timeout on it fixing the issue - I'd still like to know what this login page is it's attempting to locate is for.]
    -A

  • TS1398 wi-fi network not providing an internet connection

    wi-fi network not providing an internet connection
    I have done everything there is to do. Reset my netgear reset password etc and still no connection.  I use to have connection but got a new I pad and can not set it up.

    You may not really be connected to your WiFi network.
    Your router may not have given your iPad a valid IP address. Go to Settings > Wifi > your network name and touch the "i" to the right to see the network details. If the IP address shown starts with 169 or is blank then your router didn't provide an IP address and you won't be able to access the Internet.
    Sometimes the fix can be as simple as restarting your router (remove power for 30 seconds and restart). Do not reset your router. Next, reset network settings on your iPad (Settings > General > Reset > Reset Network Settings) and then attempt to connect. In other cases it might be necessary to update the router's firmware with the latest from the manufacturer's support web pages.
    If you need more help please give more details on your network, i.e., your router make, model and version, the wifi security being used (WEP, WPA, WPA2), etc.

  • An alert message pops up upon opening saying could not initiate application security component, and it says to check to see if profile has no read/write restrictions.

    An alert message pops up upon opening saying could not initiate application security component, and it says to check to see if profile has no read/write restrictions. Than when it opens all of my saved passwords are gone, I use a master password and its disabled. When I try to enter in a new on e it says can't change password. I can't even open yahoo e-mail says that my ssl security is down but when I check it its clicked. I'm just very confused as to whats going on.
    == This happened ==
    Every time Firefox opened
    == 5/14/2010 ==
    == User Agent ==
    Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.5 (KHTML, like Gecko) Chrome/4.1.249.1064 Safari/532.5

    See [[Could not initialize the browser security component]]
    Rename (or delete) secmod.db (secmod.db.old) in the [http://kb.mozillazine.org/Profile_folder_-_Firefox Profile Folder] in case there is a problem with the file.

  • Clean Access Server could not establish a secure connection

    I have a OOB Real IP GW setup on v4.1.2
    I seem to have a problem with the CAS connecting to the CAM although I have added the CAS to the CAM and can manage the CAS from the CAM.
    I noticed while troubleshooting client authentication that the client was not being redirected to the logon web page and it had full access to the trusted network from the untrusted authentication vlan. I eventually figured out that if I change the CAS Filter Fallback method from Allow to ignore then it tries to authenticate the client. However the fact that the fallback is activated tells you that something is not right.
    I have 2 problems:
    A) The clients web page is redirected for authentication but it only lists the domain name in the URL and not the hostname or host IP. In the lab I do not have a DNS server and it would not help as it does not include the hostname in the URL anyway. How do I fix this or perhaps it's related to the 2nd problem.
    B) When I manually change the URL by replacing the domain name with the IP of the CAS (untrusted OOB Real IP GW) then I get the following error message when logging on:
    Network Error:
    Clean Access Server could not establish a secure connection to Clean Access Manager at mydomain.com.
    This could be due to one or more of the following reasons: 1) Clean Access Manager certificate has expired 2) Clean Access Manager certificate cannot be trusted or 3) Clean Access Manager cannot be reached.
    Please report this to your network administrator.
    I would guess the culprit is No 2 but surely the system can run on self signed certificates? I have an NTP server so time is in sync. I have even tried regenerating the cetificates on the CAM
    & CAS.
    Any ideas?

    To overcome problem B, I regenerated the SSL Certificates using the host IP address instead of the name for all the CAM & CAS appliances. This seems to have resolved this problem.
    I also SSH'd from each of the CAS's to each of the CAM's from the CLI and it then prompts to permanently store the certificates. I'm not sure it this was necessary though.

  • Why can I not make a secure connection using safari?

    why can I not make a secure connection using safari?

    I have the exact same problem.  I just updated to 4.3.3 and now my inline controls on my earphones don't work.  The earphones work, but the controls don't.  It doesn't even recognize that there is a mic attached.  Even with the earphones in it still uses the built in mic. Why did my controls stop working?!

  • TS1424 itunes could connect to this iphone could not establish a secure connection to this device

    itunes could not connect to this iphone could not establish a secure connection to this device

    Same problem with my iPhone 4S on iMac and MacBook Pro with OSX Mountain Lion
    iPod work fine...
    USB is connectet directly to computer not HUB.
    Battery is on 88%
    No updates available on App Store...
    God back Steve for few more years please

  • Network Error: Clean Access Server could not establish a secure connection to Clean Access Manager

    Hello everyone
    I am implementing a failover solution of NAC in OOB VG version 4.8, I have 2 CAS and 2 CAM.
    The Error I am getting is when I connect to both IP address and the FQDN of the CAS.
    ===========
    Network Error:
    Clean Access Server could not establish a secure connection to Clean Access Manager at camsrv3.cadivi.gob.ve.
    This could be due to one or more of the following reasons: 1) Clean Access Manager certificate has expired 2) Clean Access Manager certificate cannot be trusted or 3) Clean Access Manager cannot be reached.
    Please report this to your network administrator.
    ==========
    For the CAM's I use this names camsrv1 and camsrv2. then generate a CSR in the camsrv1 with the name camsrv3.mycompany.com corresponding  to virtual ip and it exported to camsrv2, Install the CA certificate of the company and everything works perfect.
    This is the failover configuration
    CAM:
    Primary:     10.1.206.248 camsrv1.mycompany.com
    Secondary: 10.1.206.249 camsrv2.mycompany.com
    Virtual:       10.1.206.250 camsrv3.mycompany.com
    Then I do exactly the same steps for the CAS's and this is the failover configuration:
    Primary:     10.1.216.248 cassrv1.mycompany.com
    Secondary: 10.1.216.249 cassrv2.mycompany.com
    Virtual:       10.1.216.250 cassrv3.mycompany.com
    Then I add the certificate of CAM in the CAS on the tab "Trusted Certificate Authorities"  and vice versa.
    The communication between all the CAM´s and CAS´s is correct (Primary, Secondary and Virtual). I can ping the IP and the FQDN and I can also manage the CAS through the CAM.
    I verify that the time was right in the CAM and the CAS and all good up there.
    Appreciate your help
    Eduardo Navas

    Eduardo,
    Bump up the CAS/CAS communications logging on both the CAS and CAMs, and then look in the log files for clues.
    On CAM they live in /perfigo/control/tomcat/logs and on CAS in /perfigo/access/tomcat/logs
    HTH,
    Faisal
    If you find this post helpful, please rate so others can find the answer easily

  • How to update to ios6 when "could not establish a secure connection to the device" message appears with Jailbroken iPhone 4

    Hi all,
    I've been trying to update my Jailbroken iPhone 4 to ios6 but, unfortunately, I keep getting the "could not establish a secure connection to the device" when connecting it to iTunes. I've tried updating "over the air" but this flags up an error too. Finally, I can't restore to a previous backup because, the backups I previously had, were stored on my old (broken) computer.
    CAn anyone help? Any suggestions would be greatly appreciated!
    Thanks,
    Rakesh.

    You jailbroke your phone.
    Only google may help now.
    You'll find no help here.
    If Haiku you don't like,
    Then to Google you should hike,
    You jailbroke your phone,
    Now on these forums you are alone,
    'Tis a day of no cheer,
    For we cannot help here.
    In non-poem; You jailbroke your phone, which is not support by Apple, meaning updates will not work on it as they would if you were running official software.
    As per the ToC for the device, and for these Discussion Boards (both you agreed too), you will not get support either from the discussion board, or from Apple directly.
    Your best bet is to Google for help and learn a valuable lesson; Jailbreaking can definitely brick your phone.

  • Brand new Open Directory server not authenticating 10.9, 3.3.2

    I'm hoping somebody here has ran into this as it's driving me up a wall.
    I'm on a completely clean install of OS X Mavericks, with the installation from the App Store.
    On top of that, a completely clean install of Server.app 3.2.2 is installed.
    This server has a FQDN, and when I check to see if the hostname resolves in DNS, it totally does. DNS is not turned on as a service, but DNS server settings are correct and the server can hit the outside internet just fine.
    So my steps are as follows: Install Mavericks, clean onto a new partition. Update with all patches. Set Static IP. Install Server 3.2.2 which installs without error. Check hostname settings. All good there. Verify permissions. Create OD Master. I cannot get a single newly created with Server.app Local Network user to log in, even with home folders all 100% local to the client machine. I've unbound and rebound the client machine. I've restarted everything. Nothing.
    When attempting to log in, if I set it to reset password at next login, the prompt to reset the password will appear. I know at least initial auth is taking place, or I wouldn't be getting a password reset screen. After attempting to reset the password, neither the original temporary nor reset password will work. Users cannot log in.
    Here are the errors generated, with my info edited out:
    Jan 14 17:49:35 server slapd[111]: passwd_extop: (null) changed password for uid=test,cn=users,dc=controller,dc=domain,dc=edu
    Jan 14 17:49:35 server slapd[111]: => bdb_idl_delete_key: c_get failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30994)
    Jan 14 17:49:35 server slapd[111]: conn=1181 op=3: attribute "entryCSN" index delete failure
    Jan 14 17:49:41 server slapd[111]: => bdb_idl_delete_key: c_get failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30994)
    Jan 14 17:49:41 server slapd[111]: conn=1197 op=3: attribute "entryCSN" index delete failure
    I understand this is common for users upgrading from 10.6.8 but this is completely clean. I'm not usually administering an OS X server; I'm completely lost.
    Have tried: Recreating master, rekerberizing
    Using scutil and host to verify the DNS on the server works perfectly. Am I missing something small with DNS? We are a fairly large org with DNS not being provided by this server. If you think a different log file would help, please let me know which one.

    What do you get from this:
    sudo /usr/libexec/slapd -Tt
    Anything in /Library/Logs/slapconfig.log?
    Also, have you tried the suggestion here:
    Open Directory - Local Network User/Group - GONE

  • Can't log in to Lion Server. Open Directory Log Message says: unable to connect to password server

    I am setting up Lion Server. I can't log in to Lion Server from client.
    Checking the Open Directory Log: says: "unable to connect to password server" or
    "3394.14268, Node: /LDAPv3/127.0.0.1, Module: AppleODClient - unable to read Password Server response - connection to Password Server was closed, socket fd 18 (5205)"
    Thanks for help with this.

    I never discovered the problem, and instead rebuilt the server from the ground up.  I followed instructions at this discussion thread.  Very helpful.
    How To Install A (Almost) Working Lion Server With Profile Management/SSL/OD/Mail/iCal/Address Book/VNC/Web/etc.
    I have had some log-in problems with users.  I have found that restarting the server helps. If this doesn't work, I rebuild permissions on the server, followed by opening up Workgroup Manager, go to the user's password, click on options and require that the user change password on the next log-in. For some reason, this will usually fix the problem.  I then log in as the user, and "change" the password to the original one. Also note, that if you import a user, the password is not brought in.  You must enter it for each user that you imported.  Even so, I have often had to resort to the re-set password procedure to enable a log-in.

  • 10.7.5 client shows open directory server not responding

    Hello,
    I am just starting to learn to use OS X Server.  I have created an Open Directory Master and want to connect my various Mac's around the home to.  My iMac is currently running 10.7.5 client and have tried to add the server as a Network Account Server  - re: below, but it shows it is not responding.
    As I am a real novice, have I missed something and how do I get this to work?
    Thanks,
    Nick

    You are likely having issues because you are not using DNS correctly.  The name "CowShed.local" is a bonjour name.  In order to properly use Open Directory you need DNS set up internally.  The reason is that the Kerberos component of Open Directory is very dependent on DNS.
    Generally, I would discourage the use of bogus top level domain.  However, since you say this is for home use, you can likely get away with the use of one (mac.leedern.int, mac.leederm.private, etc).  However, if you do, then you will not be able to use hosted services (mail, calendar, contacts, etc) transparently between the home and external networks (names will not route).
    If you own a domain name, you can use it internally and setup your DNS on the server.  Then distribute the servers's LAN IP address to all clients as the first DNS server.  This way, all your client devices can resolve the server's host name while on the LAN.
    Your journey starts at DNS.
    R-
    Apple Consultants Network
    Apple Professional Services
    Author "Mavericks Server – Foundation Services" :: Exclusively available in Apple's iBooks Store

  • Open Directory groups not showing up in Windows

    Hello,
    we are using Open Directory on a Leopard 10.2 as a primary PDC for mac, linux and windows clients.
    The Kerberos sign in works as expected, but we can not get any group created in the OD to be displayed (or selectable) from windows. All users show up, but no groups.
    Anyone got an ides or the same problem?
    Message was edited by: majs

    Same problem here. On Windows client we see only domain users, no domain groups.
    No solution yet.

  • Not showing a secure connection

    in firefox 4 its not showing when im connected to a secure connection like in previous versions

    The padlock has been replaced by the site identity button, for details on using it see https://support.mozilla.com/kb/Site+Identity+Button
    If you want to add a padlock icon to the location bar, you can use the Padlock add-on - https://addons.mozilla.org/firefox/addon/padlock-icon/

Maybe you are looking for