LDAPS fails on windows 2012 r2 "SCHANNEL error" Incompatible cipher suites

Hi, Yannick, and welcome to the UTM Community!

In fact, my guess is that the problem is that your Windows server needs to be updated.  In 9.403, some weak ciphers and algorithms were removed.  If you look in that thread here, you will find that we all had to update our SSH clients to get to the UTM.  Any luck with that?

Cheers - Bob

Hi Bob,

I updated the 2012 R2 with the latest patches, however I still have the same problem.

Best regards

*EDIT*

Disabling TLS1.2 fixes the issue, it seems that TLS1.2 can not be used to negotiate LDAPS between Sophos and Windows server 2012 R2. I found the solution in the last post on this page:

https://social.technet.microsoft.com/Forums/ie/en-US/33258ad8-2a6b-4421-9253-4e0bda459e7b/how-to-enable-tls-12-on-windows-server-2012-r2-for-ldaps-clients?forum=winserversecurity

To be honest, this is not a real solution as we now have to disable TLS1.2 on the windows server in order to link the Sophos UTM

Hi Bob,

I updated the 2012 R2 with the latest patches, however I still have the same problem.

Best regards

*EDIT*

Disabling TLS1.2 fixes the issue, it seems that TLS1.2 can not be used to negotiate LDAPS between Sophos and Windows server 2012 R2. I found the solution in the last post on this page:

https://social.technet.microsoft.com/Forums/ie/en-US/33258ad8-2a6b-4421-9253-4e0bda459e7b/how-to-enable-tls-12-on-windows-server-2012-r2-for-ldaps-clients?forum=winserversecurity

To be honest, this is not a real solution as we now have to disable TLS1.2 on the windows server in order to link the Sophos UTM

I don't recall that TLS 1.2 was the problem, Yannick, but maybe disabling that disabled the cipher and algorithm that are the problem.  Google DROWN.

Cheers - Bob