Joining the AD domain fails due to a certificate error

Last updated
Save as PDF
Share
1. Share
2. Tweet
3. Share

Views:: 483

Visibility:: Public

Votes:: 0

Category:: fas-systems

Specialty:: nas

Last Updated:

Applies to

ONTAP 9
Active Directory
Certificate

Issue

While trying to join the new AD domain, ONTAP returns the following error.

cluster::> cifs server modify -vserver svm1 -cifs-server cifsserver -domain domain.net -ou OU=Servers,OU=_Central,OU=xxxxx,DC=xxxxx,DC=xxxxx,DC=net -status-admin down

In order to create an Active Directory machine account for the CIFS server, you

must supply the name and password of a Windows account with sufficient

privileges to add computers to the

"OU=Servers,OU=_Central,OU=xxxxx,DC=xxxxx,DC=xxxxx,DC=net" container within the

"domain.net" domain.

Enter the user name: xxxxx@domain.net

Enter the password:

Error: Machine account creation procedure failed

[ 7687] Loaded the preliminary configuration.

[ 8109] Successfully connected to ip xxx.xxx.xxx.xxx, port 88 using

TCP

[ 9449] Successfully connected to ip xxx.xxx.xxx.xxx, port 636

using TCP

[ 9667] Required certificate with CA Siemens Healthineers Core

Services Root CA is not installed

[ 9670] Unable to start LDAPS: Can't contact LDAP server

[ 9670] Additional info: error:14090086:SSL

routines:ssl3_get_server_certificate:certificate verify

failed

[ 9670] Unable to connect to LDAP (Active Directory) service on

deerlmmf01ads.domain.net (Error: Can't contact LDAP

server)

**[ 9670] FAILURE: Unable to make a connection (LDAP (Active

** Directory):domain.net), result: 7642

Error: command failed: Failed to create the Active Directory machine account

"cifsserver". Reason: LDAP Error: Cannot contact the LDAP server.

Required certificate with CA Siemens Healthineers Core Services Root CA is not installed