1

I haven’t been able to find a solution yet, wondering if anyone knows of a fix. We looked at spiceworks about a year ago and things were working fine. We haven’t touched it since then and are looking at it again.

I noticed in the AD settings that SSL isn’t working anymore, its connects fine when SSL isn’t checked. The ports 389 and 636 are open as well. The user account we are using can login to a computer we also have @ourdomain.com on the end of the username and it fails with: An existing connection was forcibly closed by the remote host. - SSL_connect

Looking at the production.log I noticed its adding .LOCAL onto the username when its trying to BIND. Is that the problem? We don’t have any .LOCAL domains and not sure why that is happening. Works fine when SSL is off.

Thanks!

2 Spice ups
2

Hi,

The .local shouldn’t be causing this problem. It sounds like the SSL connection is being dropped by the AD server. So, are you seeing that connection error when saving your AD credentials or when trying to log in?

3

When you are in the AD configuration settings in spiceworks. If I check the box for SSL it errors. If I uncheck it then the connection is fine.

It was working before with SSL checked. I know the server is on Windows 2012 R2 now, I’m wondering if anything was changed with that upgrade? I think before the server was a 2008 R2 server when things were working.

4

Hi,

I’m thinking something changed. How do you have the domain entered? Do you have a CA on that new server?

5

No CA on the servers. Not sure what you mean by domain entered? If you are talking about the server I have tried FQDN and IP. For the username I have tried ourdomain\username and username@ourdomain.com

Thanks,

Dan

6

How is the Active Directory Server field entered?

7

This might not be helpful at all, but I did want to ask some questions.

You said it worked fine a year ago when it was in use:

How did you “reinstate” the Spiceworks installation?

  1. Did you just stop using it before, or stop the service, then start it back up again and start using the same install again?

  2. Did you update the prior install of Spiceworks with a newer version?

  3. Did you install a fresh copy of Spiceworks using a new installer, then import or copy over your old /data & /db files that you were using in your prior installation?

What version of Spiceworks are you using now?

What version were you using before if it is different than the current version?

In your original install, were you using the Spiceworks provided (default) Certificate, or did you import/apply your own Certificate files? “ssl-cert.pem” and “ssl-private-key.pem” files in “C:\Program Files (x86)\Spiceworks\httpd\ssl”

If you imported your own Certificate files, have you renewed your company Certificates since that time?

Maybe @jaimedelapaz can answer this one, but if it was the original default Spiceworks provided Certificate that was in use at the time of the installation:

  1. How long is the validity period of the default installed Spiceworks provided Certificate?
  2. Is it possible that Certificate expired?
  3. Would it be possible to take the Certificate files from a fresh installation (or Spiceworks can send current valid Certificate files) and replace the “ssl-cert.pem” and “ssl-private-key.pem” files in “C:\Program Files (x86)\Spiceworks\httpd\ssl” without any issues?
8

QUESTION:How did you “reinstate” the Spiceworks installation?

ANSWER:The server was setup about a year ago and it was just left running as we simply just stopped using it. At some point my coworker upgraded it to 2012 R2 and updated to the 99 version of SW. I just updated SW to 119 build that is the latest by downloading the installer and running it.

QUESTION:Did you just stop using it before, or stop the service, then start it back up again and start using the same install again?

ANSWER:Just stopped using it, it was left running and working condition.

QUESTION:Did you update the prior install of Spiceworks with a newer version?

ANSWER:Not sure as there are two of us messing with it.

QUESTION: Did you install a fresh copy of Spiceworks using a new installer, then import or copy over your old /data & /db files that you were using in your prior installation?

ANSWER: Not sure what my co worker did, but myself I just downloaded the latest 119 installer and just installed it.

QUESTION:What version of Spiceworks are you using now?

ANSWER: Latest build of 119

QUESTION:What version were you using before if it is different than the current version?

ANSWER:Not sure. Coworker I think updated it to 99 version I think thats what it was. Not sure what it was prior to that.

QUESTION:In your original install, were you using the Spiceworks provided (default) Certificate, or did you import/apply your own Certificate files? “ssl-cert.pem” and “ssl-private-key.pem” files in “C:\Program Files (x86)\Spiceworks\httpd\ssl”

ANSWER:I used our pem cert and have also updated to the latest version as it was just updated last week.

9

Hey cash, I believe I went off on a unrelated tangent with the Certificate information.

Going back over what you were saying it’s only specific to the Active Directory connection and not accepting the SSL toggle, something that I don’t have direct experience with in Spiceworks.

Jaime and the Spiceworks Employees keep regular office hours M-F. Although they do sometimes swing by after hours and on weekends, it’s not expected.

At least Jaime has some more history on versions and what’s going on when he comes back that may help him.

Don’t forget this:

I know you said there wasn’t a CA on the server:

But does that mean that there isn’t one installed, or you’re not using it?

If there is one installed and not in use, maybe check this thread out:

Or this one using LDAP over SSL with 3rd Party CA:

I know this is for an older version of Spiceworks, but has some specific settings that may be helpful:

All-in-all, if none of this works, you always have the option (and it may be easier) to troubleshoot via email support@spiceworks.com where you can send them logs and what settings you are using in a non-public setting.

10

I have tried FQDN and IP, currently its by IP.

11

Have you tried entering just the server name?

12

Just tried it again with just server name, FQDN and IP with all three DC’s and same error with SSL on. When SSL is off everything works.

13

Going back to V_S’s question:

I know you said there wasn’t a CA on the server:

But does that mean that there isn’t one installed, or you’re not using it?

If there is one installed and not in use, maybe check this thread out:

Or this one using LDAP over SSL with 3rd Party CA:

I know this is for an older version of Spiceworks, but has some specific settings that may be helpful:

1 Spice up
14

No there is no CA, that server was a fresh install specifically for Spiceworks install. Nothing fancy. Just talking to the person that setup the server and he said its a flat load of 2012 R2 and Spiceworks. Only thing we did out of the ordinary was added our cert signed by Go Daddy for logging into the spicworks webpage. Updated it to the latest cert and tried to remove it and no difference, but I don’t think that cert has anything to do with the AD connection in the Spiceworks settings.

I seen most of those links and looked through them. Didn’t see anything.

Thanks,

Dan

15

The cert would be on the AD side. When enabling AD to use SSL, the first to set up the CA.

http://wiki.servicenow.com/index.php?title=Configuring_Microsoft_Active_Directory_for_SSL_Access#gsc.tab=0

If that is not set up properly, AD wouldn’t allow SSL connections.

1 Spice up