AD LDAPS CA chain

Place the PEM-encoded CA chain that issued your domain controllers' LDAPS certificates here as ad-ldaps-ca.pem (root + any intermediates, concatenated).

If you run AD CS, export it from any domain-joined box:

# Grab the issuing chain from AHDC01's LDAPS cert
$tcp = New-Object Net.Sockets.TcpClient('ahdc01.ad.atlashorizon.net', 636)
# ...or just export from the CA console / certutil:
certutil -ca.cert ca.der
certutil -encode ca.der ad-ldaps-ca.pem

The Duo Auth Proxy refuses to start LDAPS without it (checked in entrypoint.sh). Everything except this README is gitignored.