← Back to LDAP Manager

TLS & LDAPS

Set per cluster, so a plaintext lab and a hardened production directory can coexist.

clusters:
  - name: "secure"
    host: "ldap.example.com"
    port: 636
    bind_dn: "cn=admin,dc=example,dc=com"
    base_dn: "dc=example,dc=com"
    tls:
      mode: ldaps          # none (default) | ldaps | starttls
      ca_file: /certs/ca.crt
      verify: true         # false accepts any certificate - lab only

KeyMeaning
modenone plain ldap://; ldaps TLS from the first byte; starttls connect then upgrade
ca_fileCA bundle used to verify the server certificate
cert_file / key_fileClient certificate for mutual TLS
verifytrue (default) verifies the certificate; false accepts any certificate
The paths are inside the container, so mount the certificates:

docker run -d --name ldap-manager \
  -v ./certs:/certs:ro \
  ldap-manager:latest

Ports

mode: ldaps with a configured port of 389 is raised to 636 and logged, since 389 is the plaintext default. Set port explicitly to use anything else. StartTLS uses the normal port - typically 389.

Verify it works

# LDAPS
ldapsearch -x -H ldaps://ldap.example.com:636 -D "cn=admin,dc=example,dc=com" \
  -w "$PW" -b "dc=example,dc=com" -s base "(objectClass=*)" dn

# StartTLS
ldapsearch -x -ZZ -H ldap://ldap.example.com:389 -D "cn=admin,dc=example,dc=com" \
  -w "$PW" -b "dc=example,dc=com" -s base "(objectClass=*)" dn

A certificate failure surfaces with the settings that were in play: 

LDAP connection failed: ... certificate verify failed (self-signed certificate)
[TLS mode 'ldaps', CA /certs/ca.crt, certificate verification ON]

Swap the CA, or set verify: false to confirm it is a certificate problem and not reachability. Do not leave verify: false in production.

Scope

TLS applies to every connection the app opens - entries, monitoring, schema, ACI, backup, LDIF and auth.mode: ldap binds. There is no separate TLS toggle per feature.

Next steps