LDAP wrapped in TLS from the first byte — usually a domain controller or a directory server.
LDAPS is the implicit-TLS form of LDAP: the client negotiates TLS on connect and then speaks ordinary LDAP inside it, in contrast to plain LDAP on 389 which upgrades in place using the StartTLS extended operation defined in RFC 4513. The separate port predates StartTLS and was never formally standardised by the IETF, but IANA registered it and everyone implements it — Active Directory domain controllers, OpenLDAP, and every appliance that authenticates against a directory. Active Directory also offers a TLS-wrapped global catalog on 3269.
Expose with care
The transport is encrypted, so this is the right port to use if a directory must be reachable — but the directory holds your entire user and group namespace, so restrict it to known networks or a VPN and never expose plain LDAP on 389 alongside it.
$ ldapsearch -H ldaps://TARGET:636 -x -s base -b '' namingContextsSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.