Connect to LDAP via SSL

Atlassian User LDAP supports connecting to an LDAP server over SSL/HTTPS.

Import your LDAP server's public certificate into the Confluence JVM keystore. This is the certificate that the LDAP server will use to set up the SSL encryption, and you can use any alias of your choosing in place of "ldapCert".
```
keytool -import -alias ldapCert -file <LdapServerCertificate.crt> -keystore %JRE_HOME%/lib/security/cacerts
```
Edit the file in your Confluence install directory, confluence\WEB-INF\classes\atlassian-user.xml:

Change the value of securityProtocol from "plain" to "ssl": <securityProtocol>ssl</securityProtocol>

Switch the LDAP connection to the SSL port, if it's different from the default LDAP port. If you're using the most common LDAPS port, set <port>636</port>
Add the root certificate to your default Java keystore with the following command. This is the certificate that was used to authorise the LDAP server's certificate; it will be either the one that was used for signing it, or will come from further up in the trust chain, possibly the root certificate. This is often a self-signed certificate, when both ends of the SSL connection are within the same network. Again, the exact alias is not important.
```
keytool -import -alias serverCert -file <RootCertificate.crt> -keystore %JRE_HOME%/lib/security/cacerts
```
The keytool will ask you for a password. The default password is "changeit" without the quotes.
Verify that the certificate has been added successfully by entering the following command:
```
keytool -list -keystore %JRE_HOME%/lib/security/cacerts
```
Ensure that you've updated JAVA_OPTS to specify the path to the keystore, as specified in Connecting to SSL services, before restarting tomcat/Confluence.

There's no need to specify an alias for Confluence to use; on connecting to the LDAP server, it will search through the keystore to find a certificate to match the key being presented by the server.

Connect to LDAP via SSL

Labels: