Implementing LDAPS: Can I buy the same kind of SSL certificate as I would use to secure a web domain?

0
votes

I'm looking at hardening LDAP on my domain controller (DC). To do this I need to import a security certificate to the DC.

I don't want to self sign as I've been told it is not best practice and the service I wish to integrate with LDAPS (Mimecast) does not recommend self signing.

I've created my certificate request, based upon the domain's fqdn. e.g. mydomain.local

What I'm not sure about now is where I can get a certificate based on that request.

I'm familiar with SSL for HTTPS. That process makes sense to me, the certification authority checks that I own the domain and provides a certificate that I can then install on my web server.

Will 3rd party SSL providers let me configure a certificate with the common name "mydomain.local"?

Or am I looking in completely the wrong area?

Many thanks in advance for any help that provided.

1
sslactive-directoryldapssl-certificate
IF you truely mean your name is under .local, then no, public CAs won't deliver such certificate (because local is not an existing TLD in IANA root zone). You need either to use another name (one that resolves on the global Internet) or do everything in house but that means your own CA too. - Patrick Mevzek

1 Answers

0
votes

The type of certificate is exactly the same type of certificate as you would get for securing a website, yes. However, the domain name must be a valid internet domain (not .local)

There is a good walk-through here for Using Let's Encrtypt for Active Directory Domain Controller Certificates, including all the caveats you need to be aware of.