Microsoft Security | Microsoft Entra | Microsoft Entra ID
A cloud-based identity and access management service for securing user authentication and resource access
LDAPS and root SSL
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(137.6, 15%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJB%3C/text%3E%3C/svg%3E)
Janus Bariñan
1,126
Reputation points
When using ldaps you need a certificate from the ldap server where you want to connect. What if the application setting is pointing only to the domain (ex. domain.com) instead of dc01.domain.com? Can I use the root certificate instead?
Microsoft Security | Microsoft Entra | Microsoft Entra ID
{count} votes
-
Siva-kumar-selvaraj 15,736 Reputation points Volunteer Moderator2021-04-22T17:10:41.833+00:00 Thanks for reaching out.
Could you please elaborate more, what is your current setup and for which scenario you are trying to secure ldap connection ? are you trying to connect to Azure Active Directory Domain Services managed domain? or connecting to Active Directory Domain services over LDAPS ?
Azure AD Domain Services : https://learn.microsoft.com/en-us/azure/active-directory-domain-services/tutorial-configure-ldaps
Active Directory Domain services:
https://social.technet.microsoft.com/wiki/contents/articles/2980.ldap-over-ssl-ldaps-certificate.aspx
https://techcommunity.microsoft.com/t5/sql-server/step-by-step-guide-to-setup-ldaps-on-windows-server/ba-p/385362 -
Janus Bariñan 1,126 Reputation points
2021-04-28T01:15:25.64+00:00 What I mean is this. Usually you use an LDAP ssl certificate that has the SAN of the fqdn of the ldap server (e.g. ldap.domain.com). Can you use an ldapssl like the root in the SAN instead(e.g. doman.com)?
-
Siva-kumar-selvaraj 15,736 Reputation points Volunteer Moderator
2021-06-18T06:59:13.973+00:00 Sorry for delayed response.
You could use wildcard certificate which contains DNSname/SAN name like
*.domain.com,domain.comso you can use same certificate for ldap.domain.com as well for doman.com.Hope this helps.
Sign in to comment
Sign in to answer