Skip to content

Commit 2610488

Browse files
robinharwoodrobinharwood
committed
Add draft configure-ldap-signing-certificates.md
1 parent 6e198d0 commit 2610488

2 files changed

Lines changed: 201 additions & 1 deletion

File tree

‎WindowsServerDocs/identity/TOC.yml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -534,7 +534,11 @@
534534
- name: LDAP client performance counters
535535
href: ad-ds/ldap-client-performance-counters.md
536536
- name: LDAP signing
537-
href: ad-ds/ldap-signing.md
537+
items:
538+
- name: LDAP signing overview
539+
href: ad-ds/ldap-signing.md
540+
- name: Configure certificates for LDAP
541+
href: ad-ds/configure-ldap-signing-certificates.md
538542
- name: AD DS Troubleshooting
539543
href: ad-ds/manage/AD-DS-Troubleshooting.md
540544
items:

‎WindowsServerDocs/identity/ad-ds/configure-ldap-signing-certificates.md‎

Lines changed: 196 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,196 @@
1+
---
2+
title: Configure certificates for LDAP over SSL in Active Directory Domain Services
3+
description: Learn how to create and install SSL/TLS certificates for LDAP over SSL (LDAPS) on domain controllers using Microsoft or third-party certification authorities.
4+
author: robinharwood
5+
ms.author: roharwoo
6+
ms.service: windows-server
7+
ms.topic: how-to
8+
ms.date: 12/17/2025
9+
10+
#CustomerIntent: As a domain administrator, I want to configure LDAP over SSL certificates so that LDAP communications with my domain controllers are encrypted and secure.
11+
---
12+
13+
# Configure certificates for LDAP over SSL in Active Directory Domain Services
14+
15+
LDAP over SSL (LDAPS) encrypts LDAP communications between clients and domain controllers using SSL/TLS certificates. This article shows you how to create, install, and verify SSL certificates for LDAPS on domain controllers using either Microsoft certification authorities or third-party certificate providers.
16+
17+
By default, LDAP traffic transmits unencrypted over port 389. LDAPS establishes an encrypted SSL/TLS tunnel over port 636 (or port 3269 for global catalog traffic), protecting authentication credentials and directory queries from interception. Installing a properly formatted certificate on your domain controller automatically enables the LDAP service to accept SSL connections without additional configuration. To learn more about LDAP signing and channel binding security features, see [LDAP signing for Active Directory Domain Services](ldap-signing.md).
18+
19+
## Prerequisites
20+
21+
Before configuring LDAPS certificates, ensure you have:
22+
23+
- Administrative privileges on the domain controller where you'll install the certificate
24+
25+
- Access to a certification authority (CA):
26+
27+
- Microsoft Enterprise Certificate Authority with published certificate templates, or
28+
29+
- Third-party certificate provider (such as DigiCert, Let's Encrypt, or Verisign)
30+
31+
- The Active Directory fully qualified domain name (FQDN) of each domain controller requiring LDAPS
32+
33+
- The root CA certificate installed in the Trusted Root Certification Authorities store on all domain controllers and client computers that will establish LDAPS connections
34+
35+
- Firewall rules configured to allow inbound connections on TCP port 636 for LDAPS (or TCP port 3269 for global catalog LDAPS traffic)
36+
37+
### Understand certificate requirements
38+
39+
LDAPS certificates must meet specific technical requirements to function correctly with Active Directory Domain Services.
40+
41+
#### Certificate store location
42+
43+
The certificate must be installed in one of the following locations:
44+
45+
- **Local Computer's Personal certificate store** (programmatically known as the MY store): Supported on all Windows Server versions
46+
- **NT Directory Services (NTDS) certificate store** (Windows Server 2008 and later): Recommended for modern deployments
47+
48+
Active Directory preferentially checks the NTDS store first, making it the recommended option for Windows Server 2008 and later. Using the NTDS store provides several advantages:
49+
50+
- **Preferential selection**: Active Directory checks the NTDS store first, making it easier to control which certificate is used when multiple valid certificates exist in the Local Computer's store
51+
- **Automatic detection**: Active Directory detects new certificates dropped into the NTDS store and updates SSL certificates without requiring a domain controller restart
52+
- **Manual refresh capability**: You can trigger certificate updates using the renewServerCertificate rootDSE operation without restarting the domain controller
53+
54+
To use the NTDS certificate store, install certificates into the Personal certificate store for the NTDS service instead of the Local Computer's Personal store.
55+
56+
#### Required certificate properties
57+
58+
Regardless of which certificate store you use, certificates must meet these requirements:
59+
60+
- **Enhanced Key Usage extension**: Must include Server Authentication (1.3.6.1.5.5.7.3.1) object identifier
61+
- **Subject or Subject Alternative Name**: Must contain the domain controller's Active Directory FQDN (for example, dc01.contoso.com) in either the Common Name (CN) field or as a DNS entry in the Subject Alternative Name extension
62+
- **Private key**: Must be present in the Local Computer's store, correctly associated with the certificate, and must not have strong private key protection enabled
63+
- **Cryptographic provider**: Must use the Schannel cryptographic service provider (CSP) to generate the key
64+
- **Trust chain**: Must be issued by a CA that both the domain controller and LDAPS clients trust
65+
66+
Domain controllers and clients establish trust by configuring them to trust the root CA to which the issuing CA chains.
67+
68+
## Create the certificate request
69+
70+
### [Microsoft Enterprise CA](#tab/microsoft_enterprise_ca)
71+
72+
If your domain controller has access to a Microsoft Enterprise Certificate Authority, you can request a certificate using the built-in Domain Controller certificate template. To learn more about certificate templates, see [Manage certificate templates](../ad-cs/manage-certificate-templates.md).
73+
74+
1. On the domain controller, press **Windows key + R**, type **certlm.msc**, and press **Enter**.
75+
76+
2. Expand **Personal**, then right-click **Certificates** and select **All Tasks** > **Request New Certificate**.
77+
78+
3. In the Certificate Enrollment wizard, select **Next**.
79+
80+
4. Select **Active Directory Enrollment Policy**, then select **Next**.
81+
82+
5. Select the **Domain Controller** certificate template checkbox.
83+
84+
6. Select **Enroll**.
85+
86+
The certificate is automatically installed in the Local Computer's Personal certificate store. The Domain Controller template is preconfigured with the correct properties for LDAPS, including:
87+
88+
- Server Authentication enhanced key usage
89+
- The domain controller's FQDN in the Subject Alternative Name
90+
- Automatic renewal before expiration
91+
92+
After enrollment completes, restart the domain controller to enable LDAPS.
93+
94+
### [Third-party CA](#tab/third_party_ca)
95+
96+
Use the Certreq.exe utility to create a certificate request that meets LDAPS requirements.
97+
98+
1. Create a new text file named **request.inf** with the following content, replacing `<DC fqdn>` with your domain controller's fully qualified domain name:
99+
100+
```ini
101+
;----------------- request.inf -----------------
102+
103+
[Version]
104+
Signature="$Windows NT$"
105+
106+
[NewRequest]
107+
Subject = "CN=<DC fqdn>" ; replace with the FQDN of the DC
108+
KeySpec = 1
109+
KeyLength = 2048 ; Can be 2048, 4096, 8192, or 16384
110+
Exportable = TRUE
111+
MachineKeySet = TRUE
112+
SMIME = False
113+
PrivateKeyArchive = FALSE
114+
UserProtected = FALSE
115+
UseExistingKeySet = FALSE
116+
ProviderName = "Microsoft RSA SChannel Cryptographic Provider"
117+
ProviderType = 12
118+
RequestType = PKCS10
119+
KeyUsage = 0xa0
120+
121+
[EnhancedKeyUsageExtension]
122+
OID=1.3.6.1.5.5.7.3.1 ; this is for Server Authentication
123+
124+
;-----------------------------------------------
125+
```
126+
127+
Some third-party certification authorities require additional information in the Subject parameter, such as email address (E), organizational unit (OU), organization (O), locality or city (L), state or province (S), and country or region (C). You can append this information to the Subject name. For example:
128+
129+
```ini
130+
Subject="E=admin@contoso.com, CN=dc01.contoso.com, OU=Servers, O=Contoso, L=Redmond, S=Washington, C=US"
131+
```
132+
133+
2. Open an elevated command prompt and navigate to the folder containing **request.inf**.
134+
135+
3. Generate the certificate request file by running:
136+
137+
```cmd
138+
certreq -new request.inf request.req
139+
```
140+
141+
This command creates a new file named **request.req** containing the base64-encoded certificate request.
142+
143+
4. Submit **request.req** to your certification authority:
144+
- For Microsoft Enterprise CA: Use the CA's web enrollment interface or submit through the Certification Authority console
145+
- For third-party CA: Follow your provider's certificate request submission process
146+
147+
### Install the certificate
148+
149+
After receiving the issued certificate from your certification authority, install it on the domain controller.
150+
151+
1. Save the issued certificate as **certnew.cer** in the same folder as your request file. The certificate must be base64-encoded. Some third-party CAs return certificates as base64-encoded text in email messages that you can copy into a new .cer file.
152+
153+
2. Open an elevated command prompt and navigate to the folder containing **certnew.cer**.
154+
155+
3. Install the certificate by running:
156+
157+
```cmd
158+
certreq -accept certnew.cer
159+
```
160+
161+
4. Verify the certificate installation:
162+
163+
1. Press **Windows key + R**, type **mmc.exe**, and press **Enter**.
164+
2. Select **File** > **Add/Remove Snap-in**.
165+
3. Select **Certificates**, select **Add**, choose **Computer account**, select **Next**, choose **Local computer**, and select **Finish**.
166+
4. Select **OK** to close the Add/Remove Snap-in dialog.
167+
5. Expand **Certificates (Local Computer)** > **Personal** > **Certificates**.
168+
6. Locate the newly installed certificate. The **Intended Purposes** column should display **Server Authentication**, and the **Issued To** field should show the computer's fully qualified domain name.
169+
170+
5. Restart the domain controller to enable LDAPS.
171+
172+
---
173+
174+
## Verify LDAPS connectivity
175+
176+
After installing the certificate and restarting the domain controller, verify that LDAPS connections work correctly.
177+
178+
1. On the domain controller or a domain-joined client computer, open an elevated command prompt.
179+
180+
2. Start the Active Directory Administration Tool by running:
181+
182+
```cmd
183+
ldp.exe
184+
```
185+
186+
3. In LDP, select **Connection** > **Connect**.
187+
188+
4. In the **Connect** dialog:
189+
- **Server**: Type the name of the domain controller
190+
- **Port**: Type **636**
191+
- Select the **SSL** checkbox
192+
193+
5. Select **OK**.
194+
195+
When the connection succeeds, RootDSE information appears in the right pane, confirming LDAPS is functioning. If the connection fails, verify the certificate properties match the requirements and check that the domain controller was restarted after certificate installation.
196+

0 commit comments

Comments
 (0)