How to configure LDAPS, LDAP over SSL, using CA Certificate Service on Domain Controller in Windows Server 2016

This post is to provide an instruction on how to set up LDAPS (LDAP over SSL) on Domain Controller using single-tier CA hierachy.

Reasons for Enabling LDAPS

By default, LDAP communications between client and server applications are not encrypted. This means that it would be possible to use a network monitoring

device or software and view the communications traveling between LDAP client and server computers. This is especially problematic when an LDAP simple bind is used because credentials (username and password) is passed over the network unencrypted. This could quickly lead to the compromise of credentials.

Reasons for enabling Lightweight Directory Access Protocol (LDAP) over Secure Sockets Layer (SSL) / Transport Layer Security (TLS) also known as LDAPS include:

Some applications authenticate with Active Directory Domain Services (AD DS) through simple BIND. As simple BIND exposes the users’ credentials in clear text, use of Kerberos is preferred. If simple BIND is necessary, using SSL/TLS to encrypt the authentication session is strongly recommended.
Use of proxy binding or password change over LDAP, which requires LDAPS. (e.g. Bind to an AD LDS Instance Through a Proxy Object )
Some applications that integrate with LDAP servers (such as Active Directory or Active Directory Domain Controllers) require encrypted communications. To encrypt LDAP communications in a Windows network, you can enable LDAP over SSL (LDAPS).

Prerequisite

Active Directory Service and AD LDS has been installed prior to this installation.

How to set up Active Directory Domain Service role in Windows server 2016
Setting up AD LDS on Windows Server 2016

HOW-TO

Step 1. Add Active Directory Certificate Service on Domain Controller.