Looking for best secure way to enable LDAPS support in ActiveDirectory / on DMZ servers, I did some leg work but I would like to run this by you guys.

I don't have CA available, and domain is .local so I can't purchase signed cert. ( at this point migration to TLD is not an option. )

I found tutorial that showing that I can create self signed certificate with makecert, are there any issues doing that ... ?


Run - makecert -a sha1 -eku -sky exchange -sr localmachine -ss MY -pe -r -n "CN=DCNAME2" -len -m 12 LDAP.cer

From MMC - Certificates go to Personal Store - export created certificate with KEY

Then import the PFX file that was created in previous step under Local Computer - Trusted Root Certificates.

Does this make sense... ? and what are the security implications, any better way of doing it.


migrated from security.stackexchange.com Mar 21 at 4:19

This question came from our site for information security professionals.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy