Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have enabled LDAPS in my Windows AD environment. Using LDP.exe, I am able to connect to the server in question on port 636 with the SSL option both checked and unchecked. Does that mean that plaintext is being passed over port 636 with the option unchecked? Is it possible to force the server to listen for SSL traffic only on port 636?

SSL Unchecked:

ld = ldap_open("", 636);
Established connection to
Retrieving base DSA information...
Getting 1 entries:
Dn: (RootDSE)

SSL Checked:

ld = ldap_sslinit("", 636, 1);
Error 0 = ldap_set_option(hLdap, LDAP_OPT_PROTOCOL_VERSION, 3);
Error 0 = ldap_connect(hLdap, NULL);
Error 0 = ldap_get_option(hLdap,LDAP_OPT_SSL,(void*)&lv);
Host supports SSL, SSL cipher strength = 128 bits
Established connection to
Retrieving base DSA information...
Getting 1 entries:
Dn: (RootDSE)
share|improve this question
After running some Wireshark traces, it appears that the data is encrypted regardless if the SSL box is checked. I would still be interested to hear from anyone who may have some insight about this behavior. – Garrett Dumas Jan 3 '13 at 17:38
up vote 2 down vote accepted

That checkbox exists.for the scenario where the service may be on a non-default port. It does not enable the client to override server encryption settings/requirements.

share|improve this answer
That makes sense. Thanks for the insight. – Garrett Dumas Jan 3 '13 at 22:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.