I have an AD RODC running on Server 2012 R2 Core in my perimeter network. I am using this for external/hosted applications that can do LDAPS based auth. My problem is that the FQDN of the server is an internal-only name (rodc-01.company.local). I have an A-record in external DNS and external DNS for a friendly name (auth.company.com). I have already verified that normal, non-SSL LDAP traffic over port 389 functions fine for both internal and external applications.
Ideally, I want to only use LDAPS, but according to Microsoft, the FQDN of the server needs to be either in the common name or the SAN of the certificate. Given that I need to use this with external applications, I need a trusted third-party certificate. I obtained one through GoDaddy for auth.company.com. The RODC refuses to recognize the certificate (CAPI2 logs provide a host-name mismatch error). Trusted third-party cert providers do not issue certs for .local domains. Is there a way around this? I can issue a cert from my internal CA infrastructure, but then the external applications refuse to connect because they don't trust the cert, and not all the applications enable me to provide them the cert to trust.
Does anyone have knowledge, or experience making this work? Microsoft has left us in a real bind by putting this requirement on LDAPS.