What do I need to ldapsearch AD?

Question

I'm attempting to test LDAP for Moodle auth, by using LDAP search. When I run

$ ldapsearch -H ldaps://totally.legit.hostname "(uid=jldugger)" -b dc=example,dc=org memberOf

I get back:

ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1)
additional info: TLS error -5950:File not found`

I'm not clear on what that TLS error means, and my google-fu is failing me. I understand AD servers usually function as a CA, and odds are this one is not signed, is that what -5950 means? If so, any hints on overcoming TLS verification so I can continue on to figure out the proper baseDN, OU, and other settings?

edit1: I'm able to open up a port to the AD server with netcat, so clearly AD is at least listening on the port.

Answer 1

On Active Directory domain controllers, LDAPS support is optional, and needs a proper certificate to be enabled; otherwise, only LDAP services are provided. A quick way to check if your server supports LDAPS is to try a connection to its TCP port 636 (or run netstat on the server itself): if it's closed, LDAPS is not enabled and you should either enable it or fall back to plain LDAP.

BTW, domain controllers don't "usually function as a CA", and running a CA on one of them is a very bad practice; supplying them with a proper certificate to support LDAPS is higly advised, but the CA should really be implemented somewhere else.