How To Enable LDAPS on an AD Domain Controller

Before you Begin

Configure Certificate Authority on the Domain Controller

Add the Active Directory Certificate Services Role

1. Open Server Manager (Start > Server Manager) and Click Add Roles and Features.
2. After the Add Roles and Features wizard opens, click Next. 
3. Click Role-based or feature-based installation, click Next
   
4.  Choose Select a Server from the server pool, click Next
5.  Check the box next to Active Directory Certificate Services and a confirmation window will appear. Click Add Feature. Then Click Next. 
6. Do not select any features on the Features list. Click Next.
7. Now you will walk through the Active Directory Certificate Services Install. 

Configure the Certificate Authority

On the Active Directory Certificate Service page, please read the things to note: 

1.  After clicking next, select Certificate Authority, then click Next.
2. On the Confirm installation selections screen, check the box Restart the Destination Server Automatically if Required. Then click Install.
   On the confirm installation selections, please first read the information provided and validate the installations are approved for your organization. Additionally, consider if an outage window is required for the required restart.

   

3.  After the installation completes, click on Configure Active Directory Certificate Services on the destination server. 
4. On the Credentials step, you can choose to use the credentials of the current logged in user, or change them. Click Next. 
5.  Check Certificate Authority on the Role Services page. Click Next. 
6.  Choose Enterprise CA. Click Next. 
   Before clicking next

   Please consider the implications of creating an Enterprise Certificate Authority and work with your team to validate this is an appropriate option for your organization.  

   

7. If this is the first Certificate Authority in your Active Directory Domain then select Root CA, otherwise, work with your team to determine if Root or Subordinate CA makes sense for your organization. Our environment will be using Root CA. 
   If setting this domain controller up as a Subordinate CA, then stop here, work with your Server team, then skip to create the certificate template. 
8.  Select Create a New Private Key. Click Next. 
9. On the Cryptography settings you need to select the hash algorithm that complies with your security policies. For this demonstration, we will use SHA256. 
10. Specify the Common Name, Distinguished Name Suffix, and Distinguished Name of the Certificate Authority in accordance with your company naming conventions. 
11.  Keep the validity period set to 5 years. Click Next.
12. Keep the database locations as their default locations. Click Next. 
13. Validate the values, the click Configure.  
14. After is completes, click Close. Then Close out of the Add Roles and Features Wizard. 

Create the Certificate Template

1. Type Windows Key + r to open Run, then type certtmpl.msc and hit enter. 
2. Locate Kerberos Authentication, right click and click Duplicate Template
3. Click General at the top and change the Template Display Name to LDAPS Template, then check Publish Certificate in Active Directory
4.  Click Request Handling and check the box next to Allow Private Key to be Exported. 
5.  Click Subject Name and ensure DNS Name is the only item checked under Build from this Active Directory Information. Then click Apply and OK. 

Issue the Certificate Template

1. Click Start then type Certification Authority
2. Expand the Server --> Right click on Certificate Templates-->Click New -->Click Certificate Template to Issue 
3.  Scroll through the certificate templates until you reach LDAPS Template. Click it, then click OK. 

Request and Export Certificate

1.  Type windows key + r --> mmc --> file --> add / remove snap-in --> select certificates --> Click Add 
2.  Select Computer Account --> Next 
3.  Ensure Local Computer is selected --> Finish 
4.  After the wizard closes and you see Add or Remove Snap-ins --> Click OK 
5. Expand Certificates --> Expand Personal --> Right click on Certificates --> Click All Tasks --> Click Request New Certificate 
6. Click Next 
7. Ensure Active Directory Enrollment Policy is Highlighted --> Click Next 
8. Scroll until you find the LDAPS Template --> Check the box --> Click Enroll
9. If the Certificate installs successfully, click Finish 

Now you are ready to begin connecting Active Directory.