LDAPSStartTLS

LDAPSStartTLS is not a formal protocol name. It is a shorthand used to discuss securing LDAP traffic with Transport Layer Security (TLS) and may refer to two distinct approaches: LDAPS, which uses implicit TLS from the connection start, and StartTLS, which upgrades a plain LDAP connection to TLS after the initial greeting.

LDAPS (LDAP over SSL/TLS) runs TLS from the outset, typically on port 636. The client connects and immediately performs the TLS handshake, after which LDAP operations occur over the encrypted channel. Certificates are presented by the server and validated by the client as part of the TLS process. Because TLS starts before any LDAP data, the session remains encrypted for the entire exchange.

StartTLS upgrades: On standard LDAP, typically port 389, the client connects in plaintext and issues a StartTLS operation to switch to a TLS channel. After a successful TLS handshake, LDAP operations resume over the encrypted connection. StartTLS allows upgrading an existing connection and can be more firewall-friendly since the same port is used before and after the upgrade, though the upgrade itself requires a successful TLS negotiation.

Security considerations: Both approaches require proper certificate management, trusted certification authorities, hostname verification, and support for modern TLS versions (prefer TLS 1.2 or 1.3 and disable older protocols). It is important to enforce robust cipher suites, perform certificate revocation checks, and consider options like mutual TLS where appropriate. Administrators should ensure clients and servers are consistently configured to prevent downgrade and interception attacks.

Interoperability and usage: LDAPS is common in environments with legacy constraints or strict separation requirements. StartTLS is widely supported by modern LDAP libraries and is often favored for its flexibility, though some applications still rely on LDAPS for compatibility. Coordination of certificates, trust stores, and renewal remains essential in either approach.