title: Active Directory 2008R2 Serving Invalid TLS Certificate Over LDAP
body: <p>I am creating a simple client to connect to the LDAP servers running on one of my windows 2008R2 Active Directory Domain Controllers.</p>
  
  <p>I have successfully connected to the LDAP server over a non TLS connection. However, whenever I attempt to make a TLS connection, the handshake fails. After some digging, and downloading the certificate using the following command:</p>
  
  <pre><code>openssl s_client -connect &lt;domain controller&gt;:636
  </code></pre>
  
  <p>I found that the certificate being served from the LDAP server is invalid. I can see that the certificate is signed by our CA and my local system, that runs the application already has this trust established with the CA. However, It is missing all of the subject information in the certificate. The client application does not allow for this. </p>
  
  <p>After speaking with the administrator, he indicated that the certificates being generated for the domain controller systems to serve TLS certificates over LDAP is automatic and is created by our internal Microsoft Certificate Server. He was not sure how to address this. </p>
  
  <p>After numerous Google searches, I have come up pretty empty on how to resolve this. Is it something that is addressed on the certificate server? Is it something on the domain controller which is stripping the subject information? Is it some setting or configuration? Since, I do not have direct access to these systems I am at a loss on where to begin.</p>
  
  <p>Any assistance would be appreciated.
  Blindly trusting a certificate that is invalid is not an acceptable solution.</p>