We have several Linux and Windows servers using LDAPS authentication to a MS AD controller for the applications they host, that is presenting a certificate signed by our internal root CA.
Recently, the AD controllers renewed their certs automatically. From this point on, most of the Linux hosted servers failed to authenticate to this AD controller, while Windows hosted server continued to work.
Nothing on these servers changed during that time, only the AD controller certificate, sub and root certs are unchanged.
Our first thought was that the Linux hosts might not have the internal root cert imported as trusted, but why did it work before then?
Some digging revealed that this AD controller is not presenting the full certificate chain, which means the root CA cert is missing.
Importing the root CA cert to most of the systems fixed it.
How can it have been working before the renewal on these Linux machines that do NOT have the root / sub certificates trusted? Even with a correctly presented certificate chain, this connection shouldn´t be trusted, as the root CA is not known by the system.
Unfortunately, I have no access to the certificate and chain that has been used before, so I cannot compare them, but there was no key length change or similar.