AD-LDAP access over SSL is not working

Answered Question
May 19th, 2009

We have CUCM 6.13.1000-16.

We are having a problem using SSL during LDAP directory and end user authentication.

Does SSL also require certificate on the client (CUCM server) site to work? If yes, where can I can more information for the requirements?

Or are there any issues accessing Active Directory (Win2003) LDAP over SSL with CUCM 6.13 platform?

Thanks for the info.

I have this problem too.
0 votes
Correct Answer by htluo about 7 years 4 months ago

You need to install the CA cert on CUCM as directory-trust cert. (go to CUCM OS Admin > Security > Certificate Management)



  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (2 ratings)
Correct Answer
htluo Tue, 05/19/2009 - 08:11

You need to install the CA cert on CUCM as directory-trust cert. (go to CUCM OS Admin > Security > Certificate Management)



FureyaAtaker Tue, 05/19/2009 - 08:14

Thank you!! Got it.

I was also reviewing the OS-Admin guide. I came across the same info. However, i wasn't sure about the directory-trust part.

Thanks again for the quick response.


MARK BAKER Tue, 08/18/2009 - 05:02

I hope it's not too late to revisit this issue.

I just uploaded our root cert as a directory-trust and then checked the use ssl box on the LDAP server configuration. I keep getting a connection error when I submit it. I wanted to ask you what port you used for the connection? I used the default 389 and also 636.

Your assistance is greatly appreciated.

htluo Tue, 08/18/2009 - 07:28

A common mistake is to use IP address in the CUCM LDAP configuration while the LDAP certificate has the FQDN as CN (Common Name).

Due to the security design of SSL, the requested URL has to match the certificate CN.

Go to CUCM > System > LDAP to see if you're using IP address or FQDN.


MARK BAKER Tue, 08/18/2009 - 07:56

I was indeed using an IP address. I have changed to the FQDN, but still get the same error. java.lang.RuntimeException: Unexpected error: the trustAnchors parameter must be non-empty

I get this error on both callmanager v7 and Unity Connection v7.

I read another post that stated the Tomcat service needs to be restarted before it will work. I will be trying this tonight.

NOTE: I am using TCP 636 for the SSL connection.



htluo Tue, 08/18/2009 - 11:26

That is correct, you need to restart Tomcat.

Also, make sure you upload the CA cert as "Directory-Trust" (you don't need to upload the LDAP cert). For example, the CA cert was "", the LDAP cert is "ldap.mycompany.local". You should upload the Verisign one instead of the LDAP one.


MARK BAKER Tue, 08/18/2009 - 20:02


Thanks for your help. Changing the IP to the FQDN and restarting the Cisco Tomcat service allowed me to configure SSL for the LDAP integration.

Configuration steps:

1. Exported the interprise CA root certificate and then converted it to a PEM file using OpenSSL program.

2. Uploaded the enterprise CA root certificate to callmanager as a directory-trust certificate.

3. Restarted the Cisco Tomcat service.

4. Changed the LDAP server reference from IP address to FQDN.

5. Changed the TCP port from 389 to 636.

6. Submitted.


This Discussion