title: Windows LDAP API: No connection over SSL
body: <p>I’m trying to connect to an LDAP directory over SSL using the Windows LDAP C-API. This fails with error code 0x51 = LDAP_SERVER_DOWN while the event log on the client computer has this:
  <em>„The certificate received from the remote server does not contain the expected name. It is therefore not possible to determine whether we are connecting to the correct server. The server name we were expecting is eim-tsi2.sam.develop.beta.ads. The SSL connection request has failed. The attached data contains the server certificate.”</em></p>
  
  <p>This is can’t be true since “Ldap Admin” is able to connect over SSL and port 636.</p>
  
  <p>The LDAP directory is an Oracle DSEE which has the CA and the server certificate in the appropriate cert store.
  The client has the CA installed in the “Trusted Root Certification Authorities” and there in the „Local Computer“ physical store. I assumed this to be the right place for the CA since my little client program uses the Windows LDAP C-API; LDAP Admin indeed expects the CA there.</p>
  
  <p>Here is an excerpt of my program omitting the error handling and other obvious source code:</p>
  
  <pre><code>   ld = ldap_sslinit(host, LDAP_SSL_PORT, 1);
     // Set options: LDAP version, timeout ...
     rc = ldap_set_option(ld, LDAP_OPT_SSL, LDAP_OPT_ON);
     // Now connect:
     rc = ldap_connect(ld, NULL);
  </code></pre>
  
  <p>Result:
  0x51 = LDAP_SERVER_DOWN</p>
  
  <p>Connecting without SSL succeeds so the LDAP server is generally accessible.</p>
  
  <p>Since Ldap Admin is able to connect over SSL, I assume the certificates are valid and in the right place. But obviously the LDAP API expects them somewhere else and cannot get the server certificate from the server. I configured the certs as described here: <a href="https://msdn.microsoft.com/en-us/library/aa366105%28v=vs.85%29.aspx" rel="nofollow">https://msdn.microsoft.com/en-us/library/aa366105%28v=vs.85%29.aspx</a></p>
  
  <p>What am I doing wrong?</p>