Bug 1626988

Description of problem:

customer is trying to connect to the AD. if using ldaps it fails on the connection reset by peer.
We collected the tcpdump and see that the AD server is resetting the connection when the TLS handshake starts.

- we know (from tcpdump) that during the TLS handshake between OCP and AD - the AD immediately reset the connection
- the ldap_ca.pem certificate is correct - no issue there on OCP
- from the logs you have provided the error 40 in the AD logs means in TLS -  handshake_failure
- from the logs we also see error that the Ciphers supported by client are not supported by AD


Version-Release number of selected component (if applicable):
OpenShift Container Platform 3.7.54
Microsoft Windows Server 2012 R2 Standard Version 6.3.9600 Build 9600

How reproducible:
not reproducible

Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:
Windows 8.1/2012r2

Cipher suite string	Allowed by SCH_USE_STRONG_CRYPTO	TLS/SSL Protocol Versions
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256	Yes	TLS 1.2
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384	Yes	TLS 1.2
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256	Yes	TLS 1.2
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P384	Yes	TLS 1.2
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P256	Yes	TLS 1.2, TLS 1.1, TLS 1.0
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384	Yes	TLS 1.2, TLS 1.1, TLS 1.0
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P256	Yes	TLS 1.2, TLS 1.1, TLS 1.0
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P384	Yes	TLS 1.2, TLS 1.1, TLS 1.0
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384	Yes	TLS 1.2
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256	Yes	TLS 1.2
TLS_DHE_RSA_WITH_AES_256_CBC_SHA	Yes	TLS 1.2, TLS 1.1, TLS 1.0
TLS_DHE_RSA_WITH_AES_128_CBC_SHA	Yes	TLS 1.2, TLS 1.1, TLS 1.0
TLS_RSA_WITH_AES_256_GCM_SHA384	Yes	TLS 1.2
TLS_RSA_WITH_AES_128_GCM_SHA256	Yes	TLS 1.2
TLS_RSA_WITH_AES_256_CBC_SHA256	Yes	TLS 1.2
TLS_RSA_WITH_AES_128_CBC_SHA256	Yes	TLS 1.2
TLS_RSA_WITH_AES_256_CBC_SHA	Yes	TLS 1.2, TLS 1.1, TLS 1.0
TLS_RSA_WITH_AES_128_CBC_SHA	Yes	TLS 1.2, TLS 1.1, TLS 1.0
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P384	Yes	TLS 1.2
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P256	Yes	TLS 1.2
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P384	Yes	TLS 1.2
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384_P384	Yes	TLS 1.2
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P256	Yes	TLS 1.2
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P384	Yes	TLS 1.2
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P256	Yes	TLS 1.2, TLS 1.1, TLS 1.0
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P384	Yes	TLS 1.2, TLS 1.1, TLS 1.0
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P256	Yes	TLS 1.2, TLS 1.1, TLS 1.0
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P384	Yes	TLS 1.2, TLS 1.1, TLS 1.0
TLS_DHE_DSS_WITH_AES_256_CBC_SHA256	Yes	TLS 1.2
TLS_DHE_DSS_WITH_AES_128_CBC_SHA256	Yes	TLS 1.2
TLS_DHE_DSS_WITH_AES_256_CBC_SHA	Yes	TLS 1.2, TLS 1.1, TLS 1.0
TLS_DHE_DSS_WITH_AES_128_CBC_SHA	Yes	TLS 1.2, TLS 1.1, TLS 1.0
TLS_RSA_WITH_3DES_EDE_CBC_SHA	Yes	TLS 1.2, TLS 1.1, TLS 1.0
TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA	Yes	TLS 1.2, TLS 1.1, TLS 1.0, SSL 3.0
TLS_RSA_WITH_RC4_128_SHA	No	TLS 1.2, TLS 1.1, TLS 1.0, SSL 3.0
TLS_RSA_WITH_RC4_128_MD5	No	TLS 1.2, TLS 1.1, TLS 1.0, SSL 3.0
TLS_RSA_WITH_NULL_SHA256 
Only used when application explicitly requests.	Yes	TLS 1.2
TLS_RSA_WITH_NULL_SHA 
Only used when application explicitly requests.	Yes	TLS 1.2, TLS 1.1, TLS 1.0, SSL 3.0