{"id":3191,"date":"2026-08-17T02:05:41","date_gmt":"2026-08-17T00:05:41","guid":{"rendered":"https:\/\/itsimple.info\/?p=3191"},"modified":"2026-08-17T02:06:19","modified_gmt":"2026-08-17T00:06:19","slug":"how-to-create-tls-certificate-for-active-directory-secure-ladp-connection","status":"publish","type":"post","link":"https:\/\/itsimple.info\/?p=3191","title":{"rendered":"How to Create TLS certificate for Active Directory secure LDAP connection."},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">When query Active Directory for details like user , Groups, E-mails ect . you need to open on the firewall port 389 and 636 for LDAPS . If you have Certificate Authority on your Active directory just use it to create a certificate for server authentication. The idea is to put in in personal container and after restart the domain services the AD will pick it and use it automatically as long the certificate have the full FQDN on the server as common name. Just type :<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">certlm.msc<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"> <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This will open the certificate management . under personal install the certificate with the FQDN (full name of the server) and restart the domain services service. To Create self-sign certificate :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Logon to the Domain Controller<\/li>\n\n\n\n<li>Open PowerShell in elevated mode (Right-click on PowerShell, choose Run as Administrator)<\/li>\n\n\n\n<li>Next Run the New-SelfSignedCetificate cmdlet. NOTE: Replace the DnsName to your server\u2019s FQDN name and NetBIOS name.<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-preformatted\"><strong>New-SelfSignedCertificate -DnsName SanFran-DC01.company.com, sanfran-dc01 -CertStoreLocation cert:\\LocalMachine\\My<\/strong> <\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>This cmdlet will create a self-signed cert with given DNSName and place it at Local Computer certificate store.<\/li>\n\n\n\n<li>Last step: Open Certificate console by click Start button &amp; type <strong>Manage Computer Certificates<\/strong> and open it from the search results.<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Find the newly generated Self-Signed SSL Certificate in<strong> Personal >> Certificates<\/strong>.<\/li>\n\n\n\n<li>Select the Self-Signed Certificate and drag &amp; drop to <strong>Trusted Root Certificates >> Certificates<\/strong> to <em>trust <\/em>the certificate on the domain controller.<\/li>\n\n\n\n<li>Close the Certificate console<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Now you are ready to do LDAPs to this domain controller. If you want to validate it works, you can use LDP.exe tool.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Open LDP.exe on the domain controller (or any other computer on the network)<\/li>\n\n\n\n<li>Click <strong>Connection<\/strong> menu and choose <strong>Connect\u2026<\/strong><\/li>\n\n\n\n<li>Type the domain controller FDQN and Port number as 636 and click OK. You should see \u201cEstablished connection to &lt;domain controller>\u201d and the Base DN details.<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"497\" height=\"364\" src=\"https:\/\/itsimple.info\/wp-content\/uploads\/2026\/08\/LDP-connect.png\" alt=\"\" class=\"wp-image-3192\" srcset=\"https:\/\/itsimple.info\/wp-content\/uploads\/2026\/08\/LDP-connect.png 497w, https:\/\/itsimple.info\/wp-content\/uploads\/2026\/08\/LDP-connect-300x220.png 300w\" sizes=\"auto, (max-width: 497px) 100vw, 497px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-pullquote has-vivid-green-cyan-color has-text-color has-link-color has-large-font-size wp-elements-913a8d28a4fab8f1d7b7023910a23e04\"><blockquote><p>Good Luck<\/p><\/blockquote><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>When query Active Directory for details like user , Groups, E-mails ect . you need to open on the firewall port 389 and 636 for LDAPS . If you have Certificate Authority on your Active directory just use it to create a certificate for server authentication. The idea is to put in in personal container [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[21,22,12,14,15],"tags":[],"class_list":["post-3191","post","type-post","status-publish","format-standard","hentry","category-operating-systems","category-security","category-tutorials","category-windows","category-windows-server"],"_links":{"self":[{"href":"https:\/\/itsimple.info\/index.php?rest_route=\/wp\/v2\/posts\/3191","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/itsimple.info\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/itsimple.info\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/itsimple.info\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/itsimple.info\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3191"}],"version-history":[{"count":2,"href":"https:\/\/itsimple.info\/index.php?rest_route=\/wp\/v2\/posts\/3191\/revisions"}],"predecessor-version":[{"id":3194,"href":"https:\/\/itsimple.info\/index.php?rest_route=\/wp\/v2\/posts\/3191\/revisions\/3194"}],"wp:attachment":[{"href":"https:\/\/itsimple.info\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3191"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/itsimple.info\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3191"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/itsimple.info\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3191"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}