Problems with the LDAP address book in iOS 6
Connecting to port 389 isn't wrong. It's actually &quot;standards compliant&quot;. See RFC 4511 4.14 StartTLS Operation.
From the Wikipedia page:

&quot;Servers also often support the non-standard &quot;LDAPS&quot; (&quot;Secure LDAP&quot;, commonly known as &quot;LDAP over SSL&quot;) protocol on a separate port, by default 636. LDAPS differs from LDAP in two ways: 1) upon connect, the client and server establish TLS before any LDAP messages are transferred (without a StartTLS operation) and 2) the LDAPS connection must be closed upon TLS closure.
...
LDAPS was used with LDAPv2, because the StartTLS operation had not yet been defined. The use of LDAPS is deprecated, and modern software should only use StartTLS.&quot;

iOS 6 account setup sends a starttls extended request on port 389 to the indicated server. Upon getting a success response the client (iOS in this case) initiates a tls handshake and if that completes the regular bind, etc. proceeds after that. So, the server must be able to handle both tls and non-tls connections on port 389.
Setup on the various servers is left as an exercise to the readers ;-)
So, iOS 5 and below used the LDAPS connection to port 686 but I guess iOS 6 is now &quot;modern software&quot;.
FWIW, I think the startTLS operation is superfluous. Why even bother announcing to the world over an open channel what you are going to be doing inside a secure connection?