{
  "port": 636,
  "protocol": "tcp",
  "service": "LDAPS",
  "oneLiner": "LDAP wrapped in TLS from the first byte — usually a domain controller or a directory server.",
  "whatItIs": "LDAPS is the implicit-TLS form of LDAP: the client negotiates TLS on connect and then speaks ordinary LDAP inside it, in contrast to plain LDAP on 389 which upgrades in place using the StartTLS extended operation defined in RFC 4513. The separate port predates StartTLS and was never formally standardised by the IETF, but IANA registered it and everyone implements it — Active Directory domain controllers, OpenLDAP, and every appliance that authenticates against a directory. Active Directory also offers a TLS-wrapped global catalog on 3269.",
  "exposure": {
    "verdict": "careful",
    "note": "The transport is encrypted, so this is the right port to use if a directory must be reachable — but the directory holds your entire user and group namespace, so restrict it to known networks or a VPN and never expose plain LDAP on 389 alongside it."
  },
  "checkCommand": "ldapsearch -H ldaps://TARGET:636 -x -s base -b '' namingContexts",
  "links": [
    {
      "title": "RFC 4513 — LDAP: Authentication Methods and Security Mechanisms (StartTLS)",
      "url": "https://www.rfc-editor.org/rfc/rfc4513.html",
      "kind": "spec"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry — 636",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=636",
      "kind": "iana"
    },
    {
      "title": "OpenLDAP source repository",
      "url": "https://github.com/openldap/openldap",
      "kind": "github"
    }
  ]
}