Looking for best secure way to enable LDAPS support in ActiveDirectory / on DMZ servers, I did some leg work but I would like to run this by you guys.
I don't have CA available, and domain is .local so I can't purchase signed cert. ( at this point migration to TLD is not an option. )
I found tutorial that showing that I can create self signed certificate with makecert, are there any issues doing that ... ?
Run - makecert -a sha1 -eku 22.214.171.124.126.96.36.199.1 -sky exchange -sr localmachine -ss MY -pe -r -n "CN=DCNAME2" -len -m 12 LDAP.cer
From MMC - Certificates go to Personal Store - export created certificate with KEY
Then import the PFX file that was created in previous step under Local Computer - Trusted Root Certificates.
Does this make sense... ? and what are the security implications, any better way of doing it.