ssl certificate to the AD password change - ssl

Question

I'm sing Java and tring to change the password in AD. I have imported the certificate to the server, but I get an error in the certificate.
Import's valid:
keytool -import -keystore "C:\Program Files\Java\jre6\lib\security\cacerts" -trustcacerts -alias openldap -file "C:\certnew.cer"
List's valid:
keytool -list -keystore "C:\Program Files\Java\jre6\lib\security\cacerts"
My code:
public class PassChange
{
public static void main (String[] args) {
Hashtable env = new Hashtable();
String userName = "CN=optimus,DC=ad,DC=euclid,DC=com";
String oldPassword = "euclid!23";
String newPassword = "kcube!23";
//Could also do this via command line java -Djavax.net.ssl.trustStore....
String keystore = "C:\\Program Files\\Java\\jre6\\lib\\security\\cacerts";
// 1 String keystore = "C:\\Program Files\\Java\\jre6\\lib\\security\\cacerts";
// 2 String keystore = "C:\\Program Files\\Java\\jre6\\lib\\security\\cacerts.jks";
// 3 String keystore = "c:\\";
// 1,2,3 all error
System.setProperty("javax.net.ssl.trustStore", keystore);
env.put(Context.INITIAL_CONTEXT_FACTORY,"com.sun.jndi.ldap.LdapCtxFactory");
//set security credentials, note using simple cleartext authentication
env.put(Context.SECURITY_AUTHENTICATION,"simple");
env.put(Context.SECURITY_PRINCIPAL,userName);
env.put(Context.SECURITY_CREDENTIALS,oldPassword);
//specify use of ssl
env.put(Context.SECURITY_PROTOCOL,"ssl");
//connect to my domain controller
String ldapURL = "ldaps://xxx.xxx.xxx.xxx:636";
env.put(Context.PROVIDER_URL,ldapURL);
try {
// Create the initial directory context
LdapContext ctx = new InitialLdapContext(env,null);
//change password is a single ldap modify operation
//that deletes the old password and adds the new password
ModificationItem[] mods = new ModificationItem[2];
String oldQuotedPassword = "\"" + oldPassword + "\"";
byte[] oldUnicodePassword = oldQuotedPassword.getBytes("UTF-16LE");
String newQuotedPassword = "\"" + newPassword + "\"";
byte[] newUnicodePassword = newQuotedPassword.getBytes("UTF-16LE");
mods[0] = new ModificationItem(DirContext.REMOVE_ATTRIBUTE, new BasicAttribute("unicodePwd", oldUnicodePassword));
mods[1] = new ModificationItem(DirContext.ADD_ATTRIBUTE, new BasicAttribute("unicodePwd", newUnicodePassword));
ctx.modifyAttributes(userName, mods);
System.out.println("Changed Password for: " + userName);
ctx.close();
}
catch (NamingException e) {
System.err.println("Problem changing password: " + e);
}
catch (UnsupportedEncodingException e) {
System.err.println("Problem encoding password: " + e);
}
}
}
Error message:
problem changing password: javax.naming.CommunicationException: simple bind failed: xxx.xxx.xxx.xxx:636 [Root exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target]

Answer 1

Which certificate did you import? You do NOT want the servers certificate. Rather you want the public key of the Certificate Authority. Specifically the switch -trustcacerts is meant to indicate this is a CA public key.
Guessing by the name, I wonder if you grabbed the certificate of the server.