Check the certificate presented by a domain controller, its trust chain, name, and expiration before troubleshooting LDAPS.
Before you start
Work on a copy or a controlled test when the change can affect production. Keep timestamps, screenshots and the previous configuration so the result can be compared.
Step by step
- Identify the exact FQDN used by the LDAP client.
- Test TLS on port 636 and inspect the presented certificate.
- Check SAN/CN, validity period, Server Authentication EKU, and trust chain.
- Confirm that the domain controller has the expected certificate in the computer store.
- Retest from the client using the same DNS resolution and FQDN.
Validation
Repeat the original test after the change and confirm that the expected service works without creating a new regression. Document the final state.