Enable Secure LDAP (LDAPS) on a Domain Controller¶

Generate a Self-Signed Certificate¶

Launch PowerShell as an Administrator.
Run the following command:

New-SelfSignedCertificate `
   -DnsName "adserver.example.com","adserver","10.1.1.18","example.com"`
   -CertStoreLocation cert:\LocalMachine\My

Note

"Certificate Subject Names" Include all names and addresses that clients may use to connect to the Domain Controller, such as:

FQDN (e.g., adserver.example.com)
Hostname (e.g., adserver)
IP Address (e.g., 10.1.1.18)
Domain Name (e.g., example.com)

This ensures the certificate is valid regardless of how the server is accessed.

Open the Certificate Management Console¶

Run the following command:

certlm.msc

Navigate to:

1
Personal
2
└── Certificates

Open the newly created certificate and verify:

A private key is associated with the certificate.
The certificate status shows "This certificate is OK".
The certificate is trusted.

If the Certificate Is Not Trusted¶

Navigate to:

1
Personal
2
└── Certificates

Right-click the certificate and select Copy.

Navigate to:

1
Trusted Root Certification Authorities
2
└── Certificates

Right-click and select Paste.

Reopen the certificate and verify that:

The certificate is trusted. The certificate status shows "This certificate is OK".

Tip

After importing the certificate into the Trusted Root store, restart the Active Directory Domain Services (AD DS) service or reboot the server if LDAPS does not become available immediately.