Authentication on LDAP over TLS does not work about go-ad-auth HOT 2 CLOSED

This is an issue with your code, not this library.
TL;DR: You need to use replace Server: "X.X.X.X", with Server: "<server hostname>",, most likely.

The error is telling you that your client can't verify the server's certificate because you've provided an IP and that IP is not in the certificate. That's how TLS verification works. It's going to verify the IP or hostname you've given it

It's the same reason you'll get an error in your browser when connecting to https://216.58.194.100/ instead of https://www.google.com/; The certificate for www.google.com doesn't list all the IPs it uses, it just lists www.google.com (and a few other domains.)

To fix this, you need to make sure your server has a certificate that's from a trusted CN. This could be one you purchased, a free one from LetsEncrypt, or possibly one you created (i.e. self-signed). In that last case, you'll need to make sure that the CN certificate you created is trusted on the client, or you'll get get another error.

Then in your client, connect with the hostname listed in the certificate (you'll need to make sure that hostname points to the correct server in your DNS.) The hostname will be checked to make sure it's in the cert, and the cert's CN will be checked to make sure it's trusted. If both of those things are correct, a secure, verified connection will be started.

If you can't provide those two things (a trusted CN and a certificate with the hostname in in it) then you'll have to use InsecureSkipVerify: true and be vulnerable to MitM attacks.

from go-ad-auth.

Thanks for the advice, replacing the IP with the hostname solved my problem.

from go-ad-auth.