Enable LDAPS

This page shows you how to enable LDAP over SSL/TLS (LDAPS) for Managed Service for Microsoft Active Directory (Managed Microsoft AD) to make your LDAP traffic confidential and secure. By default, the communication between Managed Microsoft AD and client applications is not encrypted for simple LDAP binds.

To enable LDAPS, you must have a certificate. This page also describes the specifications for the required certificate and how to verify and monitor it.

Request a certificate

You can request a certificate from a Public Certificate Authority (CA), Enterprise CA, Google Cloud Certificate Authority Service or use a self-signed certificate. If you use a self-signed certificate, follow the Microsoft documentation linked to the PowerShell commands in the following sections.

You can create a self-signed certificate with the New-SelfSignedCertificate command on Windows, OpenSSL, or MakeCert.

Certificate requirements

Your certificate must meet the following requirements:

  • The following table outlines the requirements for creating a self-signed certificate and lists the associated parameters used in the New-SelfSignedCertificate command. Note that the parameter or field names can vary based on how you create the certificate.
Parameter Description
Subject (subject name) It must be the wildcard-prefixed name of your Managed Microsoft AD domain to ensure that the service remains available during an upgrade or restore process. This is because domain controllers use random names that change during an upgrade or restore process. For example, if the domain name is ad.mycompany.com, the subject name must be CN=*.ad.mycompany.com
DnsName (DNS name or subject alternative name) It must include only the following:
  • Wildcard name of your Managed Microsoft AD domain
  • Managed Microsoft AD domain name
    • For example, "CN=*.ad.mycompany.com","CN=.ad.mycompany.com"
    KeySpec It must be set to 1, which denotes that it can be used for both digital signature and key exchange.
    KeyLength The minimum key size depends on the cryptographic algorithm.
  • RSA: At least 2048 bits
  • ECDSA: At least 256 bits
  • ED25519: 512 bits (Fixed length)
    		•
    KeyUsage It must include "digital signatures" and "key encipherment".
    TextExtension or EnhancedKeyUsageExtension It must have OID=1.3.6.1.5.5.7.3.1 for server authentication.
    NotBefore The time from which the certificate is valid. The certificate must be valid when enabling LDAPS.
    NotAfter The time after which the certificate is not valid. The certificate must be valid when enabling LDAPS.
    KeyAlgorithm (signature algorithm) Weak signature algorithms like SHA-1, MD2, MD5 are not supported.

    • Issuing chain: The entire certificate chain must be uploaded and must be valid. The chain must be linear and cannot have multiple chains.

    • Certificate format: The format must meet Public-Key Cryptography Standards (PKCS) #12. You must use a PFX file.

    Request from a Public CA or Enterprise CA

    To request a certificate from a Public CA or Enterprise CA, follow these steps.

    Accept the certificate on the same VM where the request is generated.

    Export the certificate in PKCS #12 format

    To export the certificate in PKCS #12 format (as a PFX file), complete the following steps:

    1. In Windows, navigate to your certificates in the Microsoft Management Console (MMC).

    2. Expand Local Computer Certificates, and navigate to Personal > Certificates.

    3. Right-click the certificate you created to enable LDAPS, and select All Tasks > Export.

    4. In the Certificate Export Wizard dialog that appears, click Next.

    5. On the Export Private Key page, select Yes to export the private key.

    6. On the Export File Format page, select Personal Information Exchange - PKCS #12 (.PFX) and Include all certificates in the certification path if possible checkbox. Click Next.

    7. On the Security page, select the Password checkbox and enter a strong password to protect the certificate. Click Next. This password is required when configuring LDAPS on your Managed Microsoft AD domain.

    8. On the File to Export page, enter the destination name and path for the PFX file to export. Click Next.

    9. Click Finish.

    To export a self-signed certificate with the private key in PKCS #12 format as a PFX file, use the Export-PfxCertificate command and to export the self-signed certificate as a PEM file, use the Export-Certificate command.

    Distribute the issuer chain to client computers

    For LDAPS to function, all client computers must trust the issuer of the LDAPS certificate. For a well-known Public CA, the client computers might already trust the issuer chain. If the chain is not trusted, complete the following steps to export the issuer chain:

    1. In Windows, navigate to your certificates in the Microsoft Management Console (MMC).

    2. Expand Local Computer Certificates and navigate to Personal > Certificates. Double-click the LDAPS certificate.

    3. In the Certificate window, click Certification Path tab.

    4. On the Certification Path tab, select the root certificate in the path.

    5. Click View Certificate.

    6. Click Details tab, and then click Copy to File...

    7. In the Certificate Export Wizard dialog that appears, select Base-64 encoded X.509 and click Next.

    8. Select the filename and location for the certificate chain, and click Finish.

    9. To copy the certificate to the client computer that establishes an LDAPS connection, use the Certificate Import Wizard dialog to import the certificate in the "Local Machine" store. Alternatively, you can distribute the certificate chain of issuing authorities to the client computers using Group Policy in Windows.

    To import a self-signed certificate into the trusted root store of the local machine, use the Import-Certificate command.