Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am working on a development machine and I am trying to connect to my LDAP server. This is what I do -

telnet ldaps- 686

then the response is -

Could not open connection to the host on port 686 : connect failed

But, the strange part is when I connect to my server -

telnet ldap- 389

then the connection is successful.

My question is, why does this happen?

Do I have to install SSL certificate on the client machine where I make the call from? I do not know much about this.

I know for a fact that the LDAP server is working fine because other applications are successfully using it currently.

share|improve this question

Could not open connection to the host on port 686 : connect failed

This means that your LDAP server is not listening on the LDAPs port, or that a firewall configuration somewhere is rejecting the connection. What makes you believe that it should be listening for LDAPS connections? If the server is one that you set up, you may want to verify that it's listening on the ports you think it should be. If it's managed by somebody else, you may want to contact them to verify the connection details.

It's possible that the server is configured to support STARTTLS. In this mode, you connect on port 389 and then upgrade the connection to SSL. You'll need an LDAP client that supports STARTTLS (which is most of them). If you're using the OpenLDAP command line tools, the -Z flag to ldapsearch enables the STARTTLS operation.

share|improve this answer
It is a server that is managed by someone else. I checked with them and they told me that the server is listening on the port 686. Could there be anything wrong at my end? – hashpling Dec 21 '10 at 14:36
Given your description of the problem it seems unlikely. A simple telnet to port 686 should be able to connect. This suggests either (a) the server is not in fact listening on port 686, or (b) a firewall rule somewhere is preventing the connection. If you are on a different network from the server, it could be outbound rules on a firewall on your network, inbound rules on the destination network, or a local firewall on the target system. – larsks Dec 21 '10 at 14:44
The default LDAPS port is 636 rather than 686 - have you tried that? – James Yale Dec 21 '10 at 15:55
Whoops, missed that. Good catch, @James. – larsks Dec 21 '10 at 16:07

It sounds like your LDAP server isn't listening for LDAPS. What is the LDAP software that you're using?

share|improve this answer
I tried to check for connectivity first using telnet. If this works fine then I will be using LDAP authentication for my application. – hashpling Dec 21 '10 at 14:34
  1. The LDAPS port is 636, not 686. Computers will call you out on attention to detail every time. Relentlessly.

  2. Telnet won't work on SSL ports. You should use the openssl client: openssl s_client -connect $ldap_host:636 -state -nbio 2>&1. That'll open the SSL connection, and leave you with a telnet like interface when you're done.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.