# AD/Interal Hybrid issue **URL:** \ **Category:** Ignition\ **Tags:** ignition81\ **Created:** [April 10, 2024, 7:56pm UTC](https://forum.inductiveautomation.com/t/ad-interal-hybrid-issue/88659 "2024-04-10T19:56:11Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Jake\_Holbrook](https://avatars.discourse-cdn.com/v4/letter/j/ce7236/32.png) [@Jake\_Holbrook](https://forum.inductiveautomation.com/u/Jake_Holbrook)\ **Post date:** [April 10, 2024, 7:56pm UTC](https://forum.inductiveautomation.com/t/ad-interal-hybrid-issue/88659/1 "2024-04-10T19:56:11Z")
Hi, I am having issues with restoring a Gateway to a new machine. (Ignition 8.1.22). I do this regularly on our Ignition 7.9 gateways without issue. I run into problems when doing this on version 8. All the settings move over as expected and everything outside of AD appears to work correctly. I have compared the new machine with a working one and they seem to have the same settings and users. Not sure what I am missing. Any insight would be appreciated. Thanks! ---
**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\ **Post date:** [April 10, 2024, 8:00pm UTC](https://forum.inductiveautomation.com/t/ad-interal-hybrid-issue/88659/2 "2024-04-10T20:00:24Z")
...What are the issues you're running into? Are you getting errors? Is there anything in the gateway logs, or if you can't log in, the wrapper.log files? ---
**Author:** ![Jake\_Holbrook](https://avatars.discourse-cdn.com/v4/letter/j/ce7236/32.png) [@Jake\_Holbrook](https://forum.inductiveautomation.com/u/Jake_Holbrook)\ **Post date:** [April 10, 2024, 8:56pm UTC](https://forum.inductiveautomation.com/t/ad-interal-hybrid-issue/88659/3 "2024-04-10T20:56:25Z")
From the logs - [profileName=AD Internal] Primary LDAP connection failed: connecting to secondary "ldaps://........." Both the primary and secondary fail immediately when trying to login or using the "verify a user Source" function on the gateway. We use our AD for controlling access to our designers. I can still log in via a default user source and have checked the settings, which match the server that is still working with AD. (On the same Ignition version) Is it possible that there is a config setting or something that needs to be changed for AD to work after installing the backup on a fresh Ignition install? Thanks! ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/7/5/7594dda9fb41af964f4aedcca3f686007b456918.png) ---
**Author:** ![bschroeder](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bschroeder/32/13260_2.png) [@bschroeder](https://forum.inductiveautomation.com/u/bschroeder)\ **Post date:** [April 10, 2024, 9:02pm UTC](https://forum.inductiveautomation.com/t/ad-interal-hybrid-issue/88659/4 "2024-04-10T21:02:39Z")
Ports all open between the gateway and the Active Directory server? Can you disable SSL and change the port to the proper one and see if that changes anything? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [April 10, 2024, 9:27pm UTC](https://forum.inductiveautomation.com/t/ad-interal-hybrid-issue/88659/5 "2024-04-10T21:27:58Z")
You have SSL enabled, which means the root/CA cert being used to sign the AD server certificate almost certainly needs to be added to Ignition's trusted certificates. > **[Security Certificates | Ignition User Manual](https://docs.inductiveautomation.com/docs/8.1/platform/security/security-certificates#adding-security-certificates-into-keystores)** > > A security certificate, also known as a digital certificate, is used to provide trust between connections. Trusted certificates establish the identity, authenticity and reliability of incoming and outgoing traffic. ---
**Author:** ![Jake\_Holbrook](https://avatars.discourse-cdn.com/v4/letter/j/ce7236/32.png) [@Jake\_Holbrook](https://forum.inductiveautomation.com/u/Jake_Holbrook)\ **Post date:** [April 10, 2024, 10:01pm UTC](https://forum.inductiveautomation.com/t/ad-interal-hybrid-issue/88659/6 "2024-04-10T22:01:09Z")
That got me on the right track! I think that would've solved my issue, but I ended up taking David's approach I found here: [SSL/TLS How-to for Active Directory LDAPS User source - #28 by david.wooffindin](https://forum.inductiveautomation.com/t/ssl-tls-how-to-for-active-directory-ldaps-user-source/28235/28) I guess I didn't have the right ideas when searching the forum previously. Thank you for your time!