I want to secure my Active Directory 2012R2 environment with TLS.
Can I use a wildcard commercial SSL certificate and can the secure version of AD (port 636) coexist with the default one (port 389)?
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.Sign up to join this community
You don't need a commercial certificate to secure LDAP in Active Directory; all computers accessing it will by definition be domain members (*), thus you can use Windows' own Certificate Services to build an AD-integrated certification authority, which will be automatically trusted by all users and computers in the domain.
(*) Should you need to perform LDAP queries from a non-domain-joined device, you'll simply need to import the root certificate of your CA into its store of trusted certificates.
The certificate will enable LDAPS on port 636. Active directory uses sign and seal and is already secure when using port 389. Yes they can coexist at the same time
This article should help explain LDAPS. http://social.technet.microsoft.com/wiki/contents/articles/2980.ldap-over-ssl-ldaps-certificate.aspx
This article explains how to use a third party certificate to enable LDAPS https://support.microsoft.com/en-us/kb/321051
According to this article the certificate must be issued to the FQDN of the server. So a wildcard certificate might not work https://technet.microsoft.com/en-us/library/cc725767(WS.10).aspx