apereo/cas · error · CertificateException

Failed to establish a connection ldap and search.

Error message

Failed to establish a connection ldap and search.

What it means

LdaptiveResourceCRLFetcher.fetchCRLFromLdap() searches LDAP for the configured CRL/certificate attribute and decodes it into an X509CRL. When the search cannot be executed or returns nothing usable (connection failure, wrong base DN, attribute missing or not binary), it throws CertificateException with this generic message; the underlying cause is logged via LoggingUtils.

Solutions

1. Read the logged underlying exception to get the true cause, then fix connectivity/credentials (test with ldapsearch -H ldap://host -b baseDn).
2. Verify base DN, search filter, and the CRL attribute name match the directory schema.
3. Flag the CRL attribute as binary in LDAP and ensure the fetcher reads the binary attribute.
4. Confirm the CRL entry exists at the searched DN with correct scope/filter.

Example fix

// before
cas.authn.x509.ldap.base-dn=ou=certs,dc=example,dc=org
cas.authn.x509.ldap.search-filter=(cn={user})
// after
cas.authn.x509.ldap.base-dn=ou=pki,dc=example,dc=com
cas.authn.x509.ldap.search-filter=(cn={user})
# and mark the CRL attribute binary in the directory

try (var conn = new LdapConnection(host, port, bindDn, bindPassword)) { conn.open(); } catch (Exception e) { /* LDAP unreachable: fix before enabling CRL fetch */ }

try {
    crlFetcher.fetch(cert);
} catch (CertificateException e) {
    LOGGER.warn("CRL fetch from LDAP failed; falling back to offline CRL", e);
}

When it happens

Trigger: fetch() delegates to fetchCRLFromLdap() and the ldaptive search fails or yields no result — unreachable LDAP host, bad bind credentials, non-existent base DN, or the CRL attribute absent/not flagged binary (the code warns when the attribute is present but not binary).

Common situations: LDAP-based CRL revocation checking enabled; firewall/DNS changes break connectivity; base DN or search-filter typos in cas.authn.x509 LDAP settings; directory stores the CRL without the binary option so raw bytes cannot be decoded.

Related errors

• Unknown CRL reason code.
• Found certificate attribute
• CRL data is not available for
• CRL data expired on [ ]
• All CRL entries have been revoked. Rejecting the first entry

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/c24577a206dcae53. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-x509-core/src/main/java/org/apereo/cas/adaptors/x509/authentication/ldap/LdaptiveResourceCRLFetcher.java:102

        try {
            val ldapURL = r.toString();
            LOGGER.debug("Fetching CRL from ldap [{}]", ldapURL);

            val result = performLdapSearch(ldapURL);
            if (result.isSuccess()) {
                val entry = result.getEntry();
                val attribute = Objects.requireNonNull(entry.getAttribute(this.certificateAttribute),
                    () -> String.format("Certificate attribute %s does not exist or has no value", this.certificateAttribute));

                if (attribute.isBinary()) {
                    LOGGER.debug("Located entry [{}]. Retrieving first attribute [{}]", entry, attribute);
                    return fetchX509CRLFromAttribute(attribute);
                }
                LOGGER.warn("Found certificate attribute [{}] but it is not marked as a binary attribute", this.certificateAttribute);
            }

            LOGGER.debug("Failed to execute the search [{}]", result);
            throw new CertificateException("Failed to establish a connection ldap and search.");

        } catch (final Exception e) {
            LoggingUtils.error(LOGGER, e);
            throw new CertificateException(e.getMessage());
        }
    }


    /**
     * Gets x509 cRL from attribute. Retrieves the binary attribute value,
     * decodes it to base64, and fetches it as a byte-array resource.
     *
     * @param attribute the attribute, which may be null if it's not found
     * @return the x 509 cRL from attribute
     * @throws Exception the exception
     */
    protected X509CRL fetchX509CRLFromAttribute(final LdapAttribute attribute) throws Exception {
        val val = attribute.getBinaryValue();

View on GitHub (pinned to e7288fc434)