Port 636 — TCP
Port 636/TCP is used for LDAP over TLS, which protects directory queries and authentication traffic. A valid certificate, trusted issuer and correct DNS name are needed for a secure connection.
What is port 636 used for?
LDAPS starts TLS immediately on TCP 636. LDAP can also be secured with StartTLS over port 389; secure Global Catalog access commonly uses TCP 3269.
Transport protocol
TCP
Security precautions
Verify the domain controller certificate, its private key, Server Authentication purpose, trusted CA chain and matching DNS name.
Should we open this port in the firewall?
Allow TCP 636 only between authorized client networks and directory servers. Do not disable certificate validation to work around TLS errors or silently fall back to unprotected LDAP.
How do I check this port?
First test TCP with Test-NetConnection SERVER -Port 636. To inspect TLS, use openssl s_client -connect SERVER:636 -servername SERVER. Windows ldp.exe can test an SSL-protected LDAP connection.
- Confirm the FQDN resolves to the intended domain controller.
- Check the server certificate, private key and CA trust chain.
- Validate the TLS handshake before testing LDAP authentication.
- Inspect LDAP bind permissions and client/server logs if TLS works but the bind fails.
FAQ — port 636 / LDAPS
Why does an LDAPS connection succeed but an LDAP bind fail?
TCP connectivity only proves that port 636 is reachable. TLS trust, certificate names, authentication policies or directory permissions may still prevent a successful bind.
Which certificate should I check for LDAPS?
The LDAP server certificate must be valid, trusted and match the server name used by the client according to the platform policy.
Are LDAPS and LDAP StartTLS the same?
Both protect LDAP using TLS, but LDAPS starts TLS when connecting on TCP 636, whereas StartTLS upgrades an LDAP connection, commonly on TCP 389.