19 lines
627 B
Markdown
19 lines
627 B
Markdown
# AD LDAPS CA chain
|
|
|
|
Place the PEM-encoded CA chain that issued your domain controllers' LDAPS
|
|
certificates here as **`ad-ldaps-ca.pem`** (root + any intermediates,
|
|
concatenated).
|
|
|
|
If you run AD CS, export it from any domain-joined box:
|
|
|
|
```powershell
|
|
# Grab the issuing chain from AHDC01's LDAPS cert
|
|
$tcp = New-Object Net.Sockets.TcpClient('ahdc01.ad.atlashorizon.net', 636)
|
|
# ...or just export from the CA console / certutil:
|
|
certutil -ca.cert ca.der
|
|
certutil -encode ca.der ad-ldaps-ca.pem
|
|
```
|
|
|
|
The Duo Auth Proxy refuses to start LDAPS without it (checked in
|
|
`entrypoint.sh`). Everything except this README is gitignored.
|