---
title: "How To Enable LDAPS on an AD Domain Controller"
slug: "enable-ldaps-on-an-ad-domain-controller"
updated: 2025-02-10T22:21:22Z
published: 2025-02-10T22:21:22Z
canonical: "help.claritysecurity.com/enable-ldaps-on-an-ad-domain-controller"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.claritysecurity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How To Enable LDAPS on an AD Domain Controller

### Before you Begin

Before you begin

- Read this document in its entirety
- Follow your internal change control policies and procedures
- Consider any potential issues that may arise
- Establish a back-out plan

## Configure Certificate Authority on the Domain Controller

NoteThis step is only required if the Domain Controller does not already have Certificate Authority configure.  
  
To validate: On the Domain Controller click on Start > Server Manager. On the left hand navigator you will see **AD CS.**  

### Add the Active Directory Certificate Services Role

1. Open **Server Manager** (Start > Server Manager) and Click **Add Roles and Features.****![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/image-1718908755536.png?sv=2026-02-06&spr=https&st=2026-10-31T10%3A51%3A35Z&se=2026-10-31T11%3A51%3A35Z&sr=c&sp=r&sig=%2B0U%2F7GBsPbkz8Z0ytHVk%2FiLm3waT6QaZjzdS5orxkWE%3D)**
2. After the **Add Roles and Features** wizard opens, click Next.
3. Click **Role-based or feature-based installation**, click Next![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202024-06-20%20at%201.39.51%E2%80%AFPM.png?sv=2026-02-06&spr=https&st=2026-10-31T10%3A51%3A35Z&se=2026-10-31T11%3A51%3A35Z&sr=c&sp=r&sig=%2B0U%2F7GBsPbkz8Z0ytHVk%2FiLm3waT6QaZjzdS5orxkWE%3D)
4. Choose **Select a Server from the server pool**, click Next![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202024-06-20%20at%201.40.30%E2%80%AFPM.png?sv=2026-02-06&spr=https&st=2026-10-31T10%3A51%3A35Z&se=2026-10-31T11%3A51%3A35Z&sr=c&sp=r&sig=%2B0U%2F7GBsPbkz8Z0ytHVk%2FiLm3waT6QaZjzdS5orxkWE%3D)
5. Check the box next to **Active Directory Certificate Services** and a confirmation window will appear. Click **Add Feature.** Then Click Next. ![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202024-06-20%20at%201.13.03%E2%80%AFPM.png?sv=2026-02-06&spr=https&st=2026-10-31T10%3A51%3A35Z&se=2026-10-31T11%3A51%3A35Z&sr=c&sp=r&sig=%2B0U%2F7GBsPbkz8Z0ytHVk%2FiLm3waT6QaZjzdS5orxkWE%3D)![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202024-06-20%20at%2012.43.49%E2%80%AFPM.png?sv=2026-02-06&spr=https&st=2026-10-31T10%3A51%3A35Z&se=2026-10-31T11%3A51%3A35Z&sr=c&sp=r&sig=%2B0U%2F7GBsPbkz8Z0ytHVk%2FiLm3waT6QaZjzdS5orxkWE%3D)
6. Do not select any features on the **Features** list. Click Next.
7. Now you will walk through the **Active Directory Certificate Services** Install.

### Configure the Certificate Authority

On the **Active Directory Certificate Service** page**,** please read the things to note:

Things to NoteThe name and domain settings of this computer cannot be changed after a certificate authority (CA) has been installed. If you want to change the computer name, join a domain, or promote this server to a domain controller, complete these changes before installing the CA. For more information, see certificate authority naming.

1. After clicking next, select **Certificate Authority,** then click Next.**![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202024-06-20%20at%201.18.25%E2%80%AFPM.png?sv=2026-02-06&spr=https&st=2026-10-31T10%3A51%3A35Z&se=2026-10-31T11%3A51%3A35Z&sr=c&sp=r&sig=%2B0U%2F7GBsPbkz8Z0ytHVk%2FiLm3waT6QaZjzdS5orxkWE%3D)**
2. On the **Confirm installation selections** screen, check the box **Restart the Destination Server Automatically if Required.** Then click **Install.**On the confirm installation selections, please first read the information provided and validate the installations are approved for your organization. Additionally, consider if an outage window is required for the required restart.

![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202024-06-20%20at%201.29.57%E2%80%AFPM.png?sv=2026-02-06&spr=https&st=2026-10-31T10%3A51%3A35Z&se=2026-10-31T11%3A51%3A35Z&sr=c&sp=r&sig=%2B0U%2F7GBsPbkz8Z0ytHVk%2FiLm3waT6QaZjzdS5orxkWE%3D)
3. After the installation completes, click on **Configure Active Directory Certificate Services on the destination server. ![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202024-06-20%20at%201.33.05%E2%80%AFPM.png?sv=2026-02-06&spr=https&st=2026-10-31T10%3A51%3A35Z&se=2026-10-31T11%3A51%3A35Z&sr=c&sp=r&sig=%2B0U%2F7GBsPbkz8Z0ytHVk%2FiLm3waT6QaZjzdS5orxkWE%3D)**
4. On the **Credentials** step, you can choose to use the credentials of the current logged in user, or change them. Click **Next. ![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202024-06-20%20at%201.34.10%E2%80%AFPM.png?sv=2026-02-06&spr=https&st=2026-10-31T10%3A51%3A35Z&se=2026-10-31T11%3A51%3A35Z&sr=c&sp=r&sig=%2B0U%2F7GBsPbkz8Z0ytHVk%2FiLm3waT6QaZjzdS5orxkWE%3D)**
5. Check **Certificate Authority** on the **Role Services** page. Click **Next. ![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202024-06-20%20at%201.36.22%E2%80%AFPM.png?sv=2026-02-06&spr=https&st=2026-10-31T10%3A51%3A35Z&se=2026-10-31T11%3A51%3A35Z&sr=c&sp=r&sig=%2B0U%2F7GBsPbkz8Z0ytHVk%2FiLm3waT6QaZjzdS5orxkWE%3D)**
6. Choose **Enterprise CA.** Click **Next. Before clicking nextPlease consider the implications of creating an Enterprise Certificate Authority and work with your team to validate this is an appropriate option for your organization. ![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202024-06-20%20at%202.22.54%E2%80%AFPM(1).png?sv=2026-02-06&spr=https&st=2026-10-31T10%3A51%3A35Z&se=2026-10-31T11%3A51%3A35Z&sr=c&sp=r&sig=%2B0U%2F7GBsPbkz8Z0ytHVk%2FiLm3waT6QaZjzdS5orxkWE%3D)**
7. If this is the first Certificate Authority in your **Active Directory** **Domain** then select **Root CA, o**therwise, work with your team to determine if Root or Subordinate CA makes sense for your organization. Our environment will be using **Root CA. ![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202024-06-20%20at%202.23.52%E2%80%AFPM.png?sv=2026-02-06&spr=https&st=2026-10-31T10%3A51%3A35Z&se=2026-10-31T11%3A51%3A35Z&sr=c&sp=r&sig=%2B0U%2F7GBsPbkz8Z0ytHVk%2FiLm3waT6QaZjzdS5orxkWE%3D)If setting this domain controller up as a Subordinate CA, then stop here, work with your Server team, then skip to create the certificate template.**
8. Select **Create a New Private Key.** Click Next. **![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202024-06-20%20at%202.28.04%E2%80%AFPM.png?sv=2026-02-06&spr=https&st=2026-10-31T10%3A51%3A35Z&se=2026-10-31T11%3A51%3A35Z&sr=c&sp=r&sig=%2B0U%2F7GBsPbkz8Z0ytHVk%2FiLm3waT6QaZjzdS5orxkWE%3D)**
9. On the Cryptography settings you need to select the hash algorithm that complies with your security policies. For this demonstration, we will use SHA256.![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202024-06-20%20at%202.31.21%E2%80%AFPM.png?sv=2026-02-06&spr=https&st=2026-10-31T10%3A51%3A35Z&se=2026-10-31T11%3A51%3A35Z&sr=c&sp=r&sig=%2B0U%2F7GBsPbkz8Z0ytHVk%2FiLm3waT6QaZjzdS5orxkWE%3D)
10. Specify the Common Name, Distinguished Name Suffix, and Distinguished Name of the Certificate Authority in accordance with your company naming conventions. ![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202024-06-20%20at%202.37.23%E2%80%AFPM.png?sv=2026-02-06&spr=https&st=2026-10-31T10%3A51%3A35Z&se=2026-10-31T11%3A51%3A35Z&sr=c&sp=r&sig=%2B0U%2F7GBsPbkz8Z0ytHVk%2FiLm3waT6QaZjzdS5orxkWE%3D)
11. Keep the validity period set to 5 years. Click Next.
12. Keep the database locations as their default locations. Click Next.
13. Validate the values, the click **Configure**.  ![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202024-06-20%20at%202.49.37%E2%80%AFPM.png?sv=2026-02-06&spr=https&st=2026-10-31T10%3A51%3A35Z&se=2026-10-31T11%3A51%3A35Z&sr=c&sp=r&sig=%2B0U%2F7GBsPbkz8Z0ytHVk%2FiLm3waT6QaZjzdS5orxkWE%3D)
14. After is completes, click Close. Then Close out of the Add Roles and Features Wizard.

## Create the Certificate Template

1. Type Windows Key + r to open Run, then type **certtmpl.msc** and hit enter.
2. Locate **Kerberos Authentication**, right click and click **Duplicate Template![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202024-06-20%20at%203.00.55%E2%80%AFPM.png?sv=2026-02-06&spr=https&st=2026-10-31T10%3A51%3A35Z&se=2026-10-31T11%3A51%3A35Z&sr=c&sp=r&sig=%2B0U%2F7GBsPbkz8Z0ytHVk%2FiLm3waT6QaZjzdS5orxkWE%3D)**
3. Click **General** at the top and change the **Template Display Name** to **LDAPS Template,** then check **Publish Certificate in Active Directory![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202024-06-20%20at%203.11.53%E2%80%AFPM.png?sv=2026-02-06&spr=https&st=2026-10-31T10%3A51%3A35Z&se=2026-10-31T11%3A51%3A35Z&sr=c&sp=r&sig=%2B0U%2F7GBsPbkz8Z0ytHVk%2FiLm3waT6QaZjzdS5orxkWE%3D)**
4. Click **Request Handling** and check the box next to **Allow Private Key to be Exported. ![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202024-07-30%20at%206.44.46%E2%80%AFAM.png?sv=2026-02-06&spr=https&st=2026-10-31T10%3A51%3A35Z&se=2026-10-31T11%3A51%3A35Z&sr=c&sp=r&sig=%2B0U%2F7GBsPbkz8Z0ytHVk%2FiLm3waT6QaZjzdS5orxkWE%3D)**
5. Click **Subject Name** and ensure **DNS Name** is the only item checked under **Build from this Active Directory Information.** Then click **Apply** and **OK.** **![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202024-07-30%20at%206.47.18%E2%80%AFAM.png?sv=2026-02-06&spr=https&st=2026-10-31T10%3A51%3A35Z&se=2026-10-31T11%3A51%3A35Z&sr=c&sp=r&sig=%2B0U%2F7GBsPbkz8Z0ytHVk%2FiLm3waT6QaZjzdS5orxkWE%3D)**

## Issue the Certificate Template

1. Click **Start** then type **Certification Authority![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202024-07-30%20at%206.50.28%E2%80%AFAM.png?sv=2026-02-06&spr=https&st=2026-10-31T10%3A51%3A35Z&se=2026-10-31T11%3A51%3A35Z&sr=c&sp=r&sig=%2B0U%2F7GBsPbkz8Z0ytHVk%2FiLm3waT6QaZjzdS5orxkWE%3D)**
2. Expand the **Server** --> Right click on **Certificate Templates**-->Click **New** -->Click **Certificate Template to Issue ![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202024-07-30%20at%206.51.49%E2%80%AFAM.png?sv=2026-02-06&spr=https&st=2026-10-31T10%3A51%3A35Z&se=2026-10-31T11%3A51%3A35Z&sr=c&sp=r&sig=%2B0U%2F7GBsPbkz8Z0ytHVk%2FiLm3waT6QaZjzdS5orxkWE%3D)**
3. Scroll through the certificate templates until you reach **LDAPS Template**. Click it, then click **OK. ![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202024-07-30%20at%206.54.13%E2%80%AFAM.png?sv=2026-02-06&spr=https&st=2026-10-31T10%3A51%3A35Z&se=2026-10-31T11%3A51%3A35Z&sr=c&sp=r&sig=%2B0U%2F7GBsPbkz8Z0ytHVk%2FiLm3waT6QaZjzdS5orxkWE%3D)**

## Request and Export Certificate

1. Type **windows key + r** --> **mmc --> file --> add / remove snap-in --> select certificates --> Click Add ![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202024-07-30%20at%206.59.33%E2%80%AFAM.png?sv=2026-02-06&spr=https&st=2026-10-31T10%3A51%3A35Z&se=2026-10-31T11%3A51%3A35Z&sr=c&sp=r&sig=%2B0U%2F7GBsPbkz8Z0ytHVk%2FiLm3waT6QaZjzdS5orxkWE%3D)![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202024-07-30%20at%207.00.41%E2%80%AFAM.png?sv=2026-02-06&spr=https&st=2026-10-31T10%3A51%3A35Z&se=2026-10-31T11%3A51%3A35Z&sr=c&sp=r&sig=%2B0U%2F7GBsPbkz8Z0ytHVk%2FiLm3waT6QaZjzdS5orxkWE%3D)**
2. Select **Computer Account** --> Next ![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202024-07-30%20at%207.02.05%E2%80%AFAM.png?sv=2026-02-06&spr=https&st=2026-10-31T10%3A51%3A35Z&se=2026-10-31T11%3A51%3A35Z&sr=c&sp=r&sig=%2B0U%2F7GBsPbkz8Z0ytHVk%2FiLm3waT6QaZjzdS5orxkWE%3D)
3. Ensure **Local Computer** is selected --> Finish ![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202024-07-30%20at%207.03.08%E2%80%AFAM.png?sv=2026-02-06&spr=https&st=2026-10-31T10%3A51%3A35Z&se=2026-10-31T11%3A51%3A35Z&sr=c&sp=r&sig=%2B0U%2F7GBsPbkz8Z0ytHVk%2FiLm3waT6QaZjzdS5orxkWE%3D)
4. After the wizard closes and you see **Add or Remove Snap-ins** --> Click OK ![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202024-07-30%20at%207.04.42%E2%80%AFAM.png?sv=2026-02-06&spr=https&st=2026-10-31T10%3A51%3A35Z&se=2026-10-31T11%3A51%3A35Z&sr=c&sp=r&sig=%2B0U%2F7GBsPbkz8Z0ytHVk%2FiLm3waT6QaZjzdS5orxkWE%3D)
5. Expand **Certificates** --> Expand **Personal** --> Right click on **Certificates** --> Click **All Tasks** --> Click **Request New Certificate ![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202024-07-30%20at%207.05.43%E2%80%AFAM.png?sv=2026-02-06&spr=https&st=2026-10-31T10%3A51%3A35Z&se=2026-10-31T11%3A51%3A35Z&sr=c&sp=r&sig=%2B0U%2F7GBsPbkz8Z0ytHVk%2FiLm3waT6QaZjzdS5orxkWE%3D)**
6. Click Next
7. Ensure Active Directory Enrollment Policy is Highlighted --> Click Next ![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202024-07-30%20at%207.07.31%E2%80%AFAM.png?sv=2026-02-06&spr=https&st=2026-10-31T10%3A51%3A35Z&se=2026-10-31T11%3A51%3A35Z&sr=c&sp=r&sig=%2B0U%2F7GBsPbkz8Z0ytHVk%2FiLm3waT6QaZjzdS5orxkWE%3D)
8. Scroll until you find the **LDAPS Template -->** Check the box --> Click **Enroll![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202024-07-30%20at%207.08.30%E2%80%AFAM.png?sv=2026-02-06&spr=https&st=2026-10-31T10%3A51%3A35Z&se=2026-10-31T11%3A51%3A35Z&sr=c&sp=r&sig=%2B0U%2F7GBsPbkz8Z0ytHVk%2FiLm3waT6QaZjzdS5orxkWE%3D)**
9. If the Certificate installs successfully, click **Finish ![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202024-07-30%20at%207.09.37%E2%80%AFAM.png?sv=2026-02-06&spr=https&st=2026-10-31T10%3A51%3A35Z&se=2026-10-31T11%3A51%3A35Z&sr=c&sp=r&sig=%2B0U%2F7GBsPbkz8Z0ytHVk%2FiLm3waT6QaZjzdS5orxkWE%3D)**

Now you are ready to begin connecting [Active Directory](/docs/active-directory-on-premises).

If you have any problems, contact your customer success team. You can also get in touch with our general support [via email](mailto:support@claritysecurity.io), open a [support ticket](https://support.claritysecurity.com/home). Our general support team is available Monday - Friday from 8:00 AM - 6:30 PM CST.