LDAP Search Over SSL (LDAPS) to Active Directory

Quick one-liner: Query Active Directory over LDAPS from Linux — import the AD CA certificate, configure trust, and run ldapsearch with encrypted connections.

🤔 Why This Matters

When you query Active Directory from a Linux server, plain LDAP sends your credentials over the network in clear text. LDAPS encrypts the connection, but for it to work, your Linux server needs to trust the Active Directory Certificate Authority (CA).

Without the CA certificate, ldapsearch over ldaps:// will fail with a certificate verification error.

🔧 Step 1: Export the AD CA Certificate

On the Active Directory server, open a Command Prompt and run:

certutil -ca.cert adca.der

This exports the CA certificate as adca.der in DER format.

🔧 Step 2: Convert the Certificate for Linux

Copy adca.der to your Linux server and convert it to PEM format:

openssl x509 -inform DER -in adca.der -out adca.crt

Verify the certificate:

openssl x509 -in adca.crt -text -noout

You should see the issuer, subject, and validity period of your AD CA.

🔧 Step 3: Install the Certificate as a Trusted CA

Copy the certificate to the system's CA trust anchors:

sudo cp adca.crt /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust

This adds the AD CA to your system's trusted certificate store. On SLES, the path is /etc/pki/ca-trust/. On Ubuntu/Debian, use /usr/local/share/ca-certificates/ and run update-ca-certificates.

🔧 Step 4: Run ldapsearch Over LDAPS

Now you can query Active Directory securely:

ldapsearch -x -W -H ldaps://adsvr.fosstech.biz \
    -D "[email protected]" \
    -b "dc=fosstech,dc=biz" \
    "*"

✅ Quick Reference