Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am trying to use ldap with ssl on Server 2008 R2. Got it all set and am able to connect using ldp.exe to the domain.name.org port 636 with the ssl checkbox. This is on the local server itself.

However - I am unable to connect using ldapsearch using ssl and port 636. No ssl and port 389 works fine using ldapsearch.

Any ideas? Do my clients need to have a certificate installed or something? I mostly just wanted to have ldap connections encrypted. Thanks for any help!

* Edit *

The command that works:

ldapsearch -x -b "dc=XX,dc=XXX,dc=org" -D "user@XXX.org" -H ldap://XX.XXX.org -W '(&(proxyAddresses=smtp*)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))'

The command that doesn't work:

ldapsearch -x -b "dc=XX,dc=XXX,dc=org" -D "user@XXX.org" -H ldaps://XX.XXX.org:636 -W '(&(proxyAddresses=smtp*)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))'

I have tried variations of -h and using the -p to specify the port.

How would I go about installing the certificate from the server 2008 onto the client?

share|improve this question
What is the ldapsearch command you are running? You will need a cert, otherwise it cannot guarantee who you are to negotiate the encrypted channel –  TheFiddlerWins Aug 22 '13 at 15:03
I updated the question with the info you mentioned. Any ideas on how to add the cert to the client machine? –  user1453561 Aug 22 '13 at 15:48

1 Answer 1

ldapsearch { -Z, -ZZ, -ZZZ } [ -p secure_port ] [ -P certificate_database ] [ -N certificate_name ] [ -K key_database ] [ -W key database password ]

You need to use a cert to connect. Long answer here., short is you'll need a way to issue certificates that are trusted by the DC/Domain you are doing the search on (usually an Enterprise CA or it's delegate).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.