Port 636: LDAPS (LDAP over TLS)

What is port 636 used for?

Port 636 is LDAPS: LDAP directory queries inside a TLS connection. Applications use it to look up users and check passwords against a directory such as Active Directory without exposing them on the network.

On 636 the TLS handshake happens before any LDAP message, so the bind, including the password, is always encrypted. It only works if the directory server has a certificate the client trusts: an expired or untrusted certificate on a domain controller is the usual reason why an application that used to authenticate suddenly cannot. The LDAP standards themselves define StartTLS on port 389 as the way to add TLS; port 636 is the older convention, registered with IANA and supported by the common directory servers.

Is port 636 TCP or UDP?

TCP. LDAPS runs over TCP 636; TLS needs a TCP connection.

Is LDAPS on port 636 better than StartTLS on 389?

Both end up with the same TLS protection. With 636 nothing can be sent before encryption starts, which is simpler to enforce at a firewall. StartTLS on 389 is the method the LDAP standards define, but a client that does not insist on it can fall back to clear text.

Port 636 vs port 3269: what is the difference?

Both are LDAP over TLS on an Active Directory domain controller. Port 636 answers for that controller's own domain. Port 3269 is the global catalog over TLS, which answers searches across every domain in the forest.

Which CompTIA exams list port 636?

CompTIA lists port 636 by number in the Network+ objectives; the A+ Core 1 port list does not include it.

• Network+ N10-009: objective 1.4 (Networking Concepts), listed as “Lightweight Directory Access Protocol over SSL (LDAPS), 636”.

The quoted text is how the objectives document lists the port. The exam puts the port in a scenario, such as a firewall rule or a failed connection; it does not only ask for the number.

Check yourself: a practice question

Written by CertSprint for this page. It is not taken from any exam.