# AD LDAPS CA chain

Place the PEM-encoded CA chain that issued your domain controllers' LDAPS
certificates here as **`ad-ldaps-ca.pem`** (root + any intermediates,
concatenated).

If you run AD CS, export it from any domain-joined box:

```powershell
# Grab the issuing chain from AHDC01's LDAPS cert
$tcp = New-Object Net.Sockets.TcpClient('ahdc01.ad.atlashorizon.net', 636)
# ...or just export from the CA console / certutil:
certutil -ca.cert ca.der
certutil -encode ca.der ad-ldaps-ca.pem
```

The Duo Auth Proxy refuses to start LDAPS without it (checked in
`entrypoint.sh`). Everything except this README is gitignored.