Password Propagation Service Fails LDAPS Certificate Validation Due to Missing Root Certificate (4383998)

When using Password Propagation Service to process password changes over LDAPS, the service fails with the following certificate validation error:

Invalid server certificate: thumbprint...

The issue occurs because the Password Propagation Service server is unable to fully validate the certificate presented by the target domain controller for the LDAPS connection.

The issuing Root CA certificate for the target domain controller LDAPS certificate was missing from the trusted certificate store on the Password Propagation Service server.

Because the Root CA was not trusted, the Password Propagation Service could not validate the certificate chain for the LDAPS certificate, causing the certificate thumbprint validation error.

1. Log in to the Password Propagation Service server.
2. Export the issuing Root CA certificate used by the target domain controller LDAPS certificate.
3. Import the Root CA certificate into the trusted Root Certification Authorities store on the Password Propagation Service server.
4. If the LDAPS certificate also uses an Intermediate or Sub-CA certificate, import that certificate into the Intermediate Certification Authorities store.
5. Validate the target domain controller LDAPS certificate from the Password Propagation Service server by running:

      certutil -f -urlfetch -verify <exported_ldaps_certificate.cer>

6. Confirm that the certificate chain validation completes successfully.
7. Restart the Quest DS Password Change Service.
8. Test another password change to confirm that Password Propagation Service can now validate the LDAPS certificate successfully.