claude generated first pass

duo-authproxy/certs/README.md

@@ -0,0 +1,18 @@
+# AD LDAPS CA chain
+
+Place the PEM-encoded CA chain that issued your domain controllers' LDAPS
+certificates here as **`ad-ldaps-ca.pem`** (root + any intermediates,
+concatenated).
+
+If you run AD CS, export it from any domain-joined box:
+
+```powershell
+# Grab the issuing chain from AHDC01's LDAPS cert
+$tcp = New-Object Net.Sockets.TcpClient('ahdc01.ad.atlashorizon.net', 636)
+# ...or just export from the CA console / certutil:
+certutil -ca.cert ca.der
+certutil -encode ca.der ad-ldaps-ca.pem
+```
+
+The Duo Auth Proxy refuses to start LDAPS without it (checked in
+`entrypoint.sh`). Everything except this README is gitignored.