I have a test domain with one domain controller. On it I have imported the root and issuing CA certificates to the appropriate certificate stores for the entire computer and have done that for every computer on the domain as well. I then imported a certificate into the NTDS Personal Certificate Store that was issued by the Issuing CA (certificate imported by double clicking on a .pfx file and following the prompts). The issued certificate has Server Authentication, a CN and SAN that match the fully qualified domain name of the domain controller, and is not expired or revoked. After setting this up I restarted the domain controller. When I try to connect via ldp.exe (using the FQDN) from another computer on the domain I am unable to connect. All ports are open so there is no firewall issue. What else can it be?
Telnet to it and see if you get an empty screen with a blinking cursor.
Use the Ldp.exe tool on the domain controller to try to connect to the server by using port 636 If you cannot connect to the server by using port 636, what are the errors that Ldp.exe generates?
Turns out the certificate I generated was incorrect. The instructions I was following said to generate a certificate with a CN (or SAN) matching the value that shows up in the Active Directory Domains and Trust (in my case, the domain name) but that didn't work for me. What ended up working was having the CN match the computer_name.domain_name. Once I did that everything worked as expected.
For example, if your domain name is example.com and your computer name is EC2AMAZ-ABC1234, then your CN (or SAN) should be EC2AMAZ-ABC1234.example.com, which may very well be your "Full Computer Name".