title: Authenticating a self-signed certificate for LDAPS connection
body: <p>I want to make a secure ldap connection(ldaps) from a Linux(Linux 3.2.0-4-amd64 #1 SMP Debian 3.2.51-1 x86_64 GNU/Linux) client to a Windows 2012 server, to change user passwords in active directory, through php.
  For that, I've created a self-signed certificate(using Windows Server Manager) on the server, but when I try to connect, I get the following error(by turning debugging option on: 
  <code>ldap_set_option(NULL, LDAP_OPT_DEBUG_LEVEL, 7);</code>):</p>
  
  <pre><code>ldap_create                                                                 
  ldap_url_parse_ext(ldaps://xxx.xxx.xxx.xxx)                                 
  ldap_bind_s                                                                 
  ldap_simple_bind_s                                                          
  ldap_sasl_bind_s                                                            
  ldap_sasl_bind                                                              
  ldap_send_initial_request                                                   
  ldap_new_connection 1 1 0                                                   
  ldap_int_open_connection                                                    
  ldap_connect_to_host: TCP xxx.xxx.xxx.xxx:636                               
  ldap_new_socket: 3                                                          
  ldap_prepare_socket: 3                                                      
  ldap_connect_to_host: Trying xxx.xxx.xxx.xxx:636                            
  ldap_pvt_connect: fd: 3 tm: -1 async: 0                                     
  TLS: peer cert untrusted or revoked (0x42)                                  
  TLS: can't connect: (unknown error code).                                   
  ldap_err2string                                                             
  PHP Warning:  ldap_bind(): Unable to bind to server 
  </code></pre>
  
  <p>It seems the client is not able to trust the certificate since it's self-signed.</p>
  
  <p>What steps should I take to make a secure connection? The client side certificates are stored in <code>/etc/ssl/certs/ca-certificates.crt</code></p>