> Source: [sk167159](https://support.checkpoint.com/results/sk/sk167159)

# sk167159 - Fetching LDAP users during Access Role creation in SmartConsole ends with "Error retrieving results"

| Property | Value |
|----------|-------|
| Solution ID | sk167159 |
| Date Created | 2020-06-14 |
| Last Modified | 2026-02-02 |
| Technical Level | Advanced |
| Products | Security Management Server, Multi-Domain Security Management Server |
| Versions | R81.20, R81.10 (EOS), R81 (EOS), R81 (EOS), R81.10 (EOS), R81.20 |
| OS | Gaia |

## Symptoms

- * Fetching LDAP users when creating Access Role in SmartConsole ends with "*Error retrieving results*" error when using SSL/LDAPS (LDAP over SSL) connection over the TCP port 636.

* Fetching LDAP in Legacy SmartDashboard works properly.

* Debug of the CPM daemon on the Management Server (see [sk143253](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk143253)):

  `$FWDIR/scripts/mgmt_debug.sh -m on -c SslLdapConnectionWrapper -s DEBUG`  
  `
  $FWDIR/scripts/mgmt_debug.sh -m on -c LdapConnectionWrapper -s DEBUG`

  shows these lines in the *$FWDIR/log/cpm.elg* file:

  `DATE TIME,PID DEBUG internal.wrappers.LdapConnectionWrapper [qtp-1059684718-365]: Got result code different from 'ResultCode.SERVER_DOWN(81)', not reconnecting.`  
  `
  DATE TIME,PID ERROR internal.wrappers.SslLdapConnectionWrapper [qtp-1059684718-365]: Failed connecting to 'XXXX.local', checking SSL errors. Directory Details: com.checkpoint.objects.ldap.connection.internal.properties.QueryAdConnectionDetails {Domain Name='XXXXX.local', Connection Key='-XXXX', Connection Info list='[SSL bind, trying to open SSL connection., Creating first SSL socket factory with protocol 'SSL_TLSv2'., SSL socket factory was created successfully., Opening the ldaps connection.]', Directory ID='XXXX', Username='XXXXX', User DN='CN=NAC Administrator,OU=Admins,XX=XXXXX,DC=local', Password='XXXX', Bind DN='DC=XXXX,XX=local', Server name / FQDN='XXXX.XXXX.local', Server IPv4='XX.XX.XX.XX', Server IPv6='', Server Uid='XXXX', Port='636', Use ssl='true', Ui fetch profile ID='XXXX', Branches list='[DC=XXXX,DC=local]'}.`  
  `
  DATE TIME,PID DEBUG internal.wrappers.SslLdapConnectionWrapper [qtp-1059684718-365]: Connect error(CONNECT_ERROR), checking if SSL connectivity(I/O) or certificate problem.`  
  `
  DATE TIME,PID DEBUG internal.wrappers.SslLdapConnectionWrapper [qtp-1059684718-365]: Checking if the error is SSLException error.`  
  `
  DATE TIME,PID DEBUG internal.wrappers.SslLdapConnectionWrapper [qtp-1059684718-365]: Error is SSL error, checking if it's SSL handshake error.`

## Cause

The LDAP certificate uses the Signature Algorithm "RSASSA-PSS".

Check Point software uses the IBM package "Java Run Time Environment 8" that does **not** support the RSSASSA-PSS cipher (for the time of this writing - June 2020).

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content