What you’re seeing
- A firewall, VPN, MFA proxy or application suddenly can't authenticate users against Active Directory.
- Application logs show TLS handshake or certificate validation errors when connecting on port 636.
- Plain LDAP connections still work, but secure LDAP connections fail.
- The failures began on a specific date without any change to the application.
Common causes
Every environment is different, but these are the causes our engineers find most often:
- The certificate the domain controller uses for LDAPS expired and wasn't renewed.
- The domain controller renewed its certificate automatically, and the application still trusts only the old one or a pinned thumbprint.
- The new certificate doesn't include the name the application connects to, such as a load-balanced or alias name.
- The application doesn't trust the internal CA chain that issued the new certificate.
- TLS version or cipher changes on the domain controller no longer match what the application supports.
Why it matters
Many critical systems check usernames and passwords against Active Directory over LDAPS: VPN gateways, firewalls, MFA services, Wi-Fi controllers and business applications. When LDAPS breaks, remote access and logins to those systems fail for everyone at once. Falling back to unencrypted LDAP to restore service sends passwords across the network in a form that can be intercepted, which creates a serious security and compliance exposure.
How AskTechGurus fixes it
Skip the trial and error. A certified engineer works on your actual system, finds the root cause, and fixes it properly.
Tell us what’s happening
Submit a ticket in about two minutes. Paste the error, describe what changed, and pick your tier. No charge to submit.
A certified engineer diagnoses it
A vetted, US-based systems engineer claims your ticket, usually within minutes during business hours, and investigates over a secure remote session you can watch and end at any time.
Fixed and verified with you
The engineer resolves the root cause and confirms with you that it’s working. You don’t just get a workaround, and you get a plain-English summary of what was wrong.
Pay only when it’s resolved
Fixed price from $99, invoiced only after you approve the fix. If it isn’t resolved, you don’t pay.
Frequently asked questions
Can we switch the device back to plain LDAP to get people working?
We don't recommend it. Plain LDAP can expose passwords on the network. The secure connection can usually be restored once the certificate issue is identified.
Will users be locked out of VPN until it's resolved?
If the VPN authenticates through LDAPS, yes. That's why the engineer starts with the systems that remote access depends on.