certmon.de DE

LDAPS certificates on domain controllers: check and renew

Firewalls, VPN gateways, NAS boxes, Linux servers and plenty of Java applications query Active Directory over LDAPS (port 636). When the certificate on a domain controller expires, those logons fail – often without a clear error message, and only against the one DC the device happens to hit.

What a DC needs for LDAPS

  • A certificate with the Server Authentication purpose (OID 1.3.6.1.5.5.7.3.1)
  • the DC's fully qualified name in the subject or the subject alternative name (SAN)
  • a private key and an issuer the clients trust
  • stored in the computer's Personal store or in the NTDS service store

With an enterprise CA, domain controllers enroll a suitable certificate automatically, typically from the “Kerberos Authentication” or “Domain Controller Authentication” template. LDAPS then simply works – until a renewal fails.

Which certificate does the DC actually present?

The most reliable test is a real connection on port 636. This function shows subject and expiry date – even if the certificate is invalid:

function Test-Ldaps([string]$Server) {
  $tcp = New-Object Net.Sockets.TcpClient($Server, 636)
  try {
    $ssl = New-Object Net.Security.SslStream($tcp.GetStream(), $false, { $true })
    $ssl.AuthenticateAsClient($Server)
    $c = New-Object Security.Cryptography.X509Certificates.X509Certificate2 $ssl.RemoteCertificate
    [pscustomobject]@{
      Server     = $Server
      Subject    = $c.Subject
      NotAfter   = $c.NotAfter
      DaysLeft   = ($c.NotAfter - (Get-Date)).Days
      Thumbprint = $c.Thumbprint
    }
  }
  finally { $tcp.Dispose() }
}

# Check all domain controllers (ActiveDirectory module)
(Get-ADDomainController -Filter *).HostName | ForEach-Object { Test-Ldaps $_ }

On Linux, openssl s_client -connect dc01.contoso.local:636 -showcerts does the same. If you prefer a GUI, use ldp.exe: Connection → Connect → port 636, tick “SSL”.

Several matching certificates: which one wins?

If there are several suitable certificates in the Personal store, Windows picks one of them – not always the one you expect. This typically happens right after a renewal or when another certificate for a different purpose also lives on the DC. Two ways to avoid it:

  • Remove expired and superseded certificates from the store after renewal.
  • Import the certificate you want into the NTDS service store (mmc → Certificates snap-in → Service account → Active Directory Domain Services → Personal). Certificates there take precedence for LDAPS.

Renewing without a reboot

A DC usually picks up a certificate renewed by autoenrollment for new connections on its own. To force the switch immediately, for example after replacing a certificate by hand, write the renewServerCertificate attribute to the domain controller's RootDSE. This is not a PowerShell cmdlet but an LDAP operation: you create an LDIF file and import it with ldifde. On the affected DC, in an elevated PowerShell:

@'
dn:
changetype: modify
add: renewServerCertificate
renewServerCertificate: 1
-

'@ | Set-Content -Path "$env:TEMP\renew.ldf" -Encoding ASCII

ldifde -i -f "$env:TEMP\renew.ldf"

ldifde should report that one entry was modified. If you prefer a GUI, use ldp.exe: connect and bind to the DC, then Browse → Modify, leave “DN” empty, attribute renewServerCertificate, value 1, operation “Add” → Enter → Run.

Then use Test-Ldaps to confirm the new thumbprint is being presented.

Devices that stored the certificate themselves

Most clients trust the root CA and never notice the certificate change. Some appliances, however, store the DC's server certificate itself, or only the issuing intermediate CA. Those devices need updating after every renewal, or after the CA itself is renewed. Wherever possible, configure the root CA on them instead.

Why doesn't the certificate renew?

It's usually Group Policy, template permissions or CA connectivity – the autoenrollment checklist goes through the causes one by one. If the issuing CA is reachable but its CRL has expired, clients will reject even a brand-new LDAPS certificate: see Expired CRL.

More guides