{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/match-pfsense-ldap-transport-hostname-and-issuing-ca-together/", "item": { "id": "https://update.dsesecurity.com/updates/match-pfsense-ldap-transport-hostname-and-issuing-ca-together/", "slug": "match-pfsense-ldap-transport-hostname-and-issuing-ca-together", "url": "https://update.dsesecurity.com/updates/match-pfsense-ldap-transport-hostname-and-issuing-ca-together/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/match-pfsense-ldap-transport-hostname-and-issuing-ca-together.md", "json": "https://update.dsesecurity.com/api/v1/posts/match-pfsense-ldap-transport-hostname-and-issuing-ca-together/" }, "title": "Match pfSense LDAP transport, hostname, and issuing CA together", "summary": "An IP address that reaches LDAP may still fail the certificate identity check.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:16:16+00:00", "modified_at": "2026-10-20T18:34:35+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 247, "potentially_affected": "This concerns pfSense LDAP authentication-server configuration.", "dse_recommendation": "DSE recommends recording the server's certificate name, DNS result, transport mode, port, and issuer as one connection profile.", "primary_source": { "name": "Netgate — LDAP Authentication Servers", "url": "https://docs.netgate.com/pfsense/en/latest/usermanager/ldap.html", "published_on": null, "authority": "docs.netgate.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

An IP address that reaches LDAP may still fail the certificate identity check.

\n

Source facts

\n

Netgate states that the configured LDAP host must match the server certificate when encrypted transport is used. STARTTLS negotiates encryption on its LDAP connection, while SSL/TLS uses the encrypted LDAP mode. The selected Peer Certificate Authority validates the server certificate and must match its issuer; the documentation distinguishes that from an optional client certificate.

\n

Source: Netgate — LDAP Authentication Servers.

\n

Applicability

\n

This concerns pfSense LDAP authentication-server configuration.

\n

DSE recommendation

\n

DSE recommends recording the server’s certificate name, DNS result, transport mode, port, and issuer as one connection profile. Resolve the intended hostname through an approved DNS path instead of disabling certificate checks when connecting by IP fails. Import only the needed trust material and avoid confusing a server-trust CA with a client identity certificate. Diagnose transport validation before changing user search filters or broadening directory permissions. Keep transport, server name, port, and selected CA on one reviewed configuration record. Ask the directory owner to confirm that combination before changing bind or search settings. Use the resulting TLS check to decide whether authentication troubleshooting should advance to account and group queries.

\n

Verification

\n

From an approved test configuration, verify name resolution and the server certificate chain with normal validation enabled. Then test a designated directory account and group lookup. Record transport, bind, and authorization results separately, and never include passwords or private keys in the diagnostic evidence.

\n

Official reference

\n

Netgate — LDAP Authentication Servers. Reviewed October 20, 2026.

", "content_text": "An IP address that reaches LDAP may still fail the certificate identity check.\nSource facts\nNetgate states that the configured LDAP host must match the server certificate when encrypted transport is used. STARTTLS negotiates encryption on its LDAP connection, while SSL/TLS uses the encrypted LDAP mode. The selected Peer Certificate Authority validates the server certificate and must match its issuer; the documentation distinguishes that from an optional client certificate.\nSource: Netgate — LDAP Authentication Servers.\nApplicability\nThis concerns pfSense LDAP authentication-server configuration.\nDSE recommendation\nDSE recommends recording the server’s certificate name, DNS result, transport mode, port, and issuer as one connection profile. Resolve the intended hostname through an approved DNS path instead of disabling certificate checks when connecting by IP fails. Import only the needed trust material and avoid confusing a server-trust CA with a client identity certificate. Diagnose transport validation before changing user search filters or broadening directory permissions. Keep transport, server name, port, and selected CA on one reviewed configuration record. Ask the directory owner to confirm that combination before changing bind or search settings. Use the resulting TLS check to decide whether authentication troubleshooting should advance to account and group queries.\nVerification\nFrom an approved test configuration, verify name resolution and the server certificate chain with normal validation enabled. Then test a designated directory account and group lookup. Record transport, bind, and authorization results separately, and never include passwords or private keys in the diagnostic evidence.\nOfficial reference\nNetgate — LDAP Authentication Servers. Reviewed October 20, 2026.", "content_markdown": "An IP address that reaches LDAP may still fail the certificate identity check.\n\n## Source facts\n\nNetgate states that the configured LDAP host must match the server certificate when encrypted transport is used. STARTTLS negotiates encryption on its LDAP connection, while SSL/TLS uses the encrypted LDAP mode. The selected Peer Certificate Authority validates the server certificate and must match its issuer; the documentation distinguishes that from an optional client certificate.\n\nSource: [Netgate — LDAP Authentication Servers](https://docs.netgate.com/pfsense/en/latest/usermanager/ldap.html).\n\n## Applicability\n\nThis concerns pfSense LDAP authentication-server configuration.\n\n## DSE recommendation\n\nDSE recommends recording the server’s certificate name, DNS result, transport mode, port, and issuer as one connection profile. Resolve the intended hostname through an approved DNS path instead of disabling certificate checks when connecting by IP fails. Import only the needed trust material and avoid confusing a server-trust CA with a client identity certificate. Diagnose transport validation before changing user search filters or broadening directory permissions. Keep transport, server name, port, and selected CA on one reviewed configuration record. Ask the directory owner to confirm that combination before changing bind or search settings. Use the resulting TLS check to decide whether authentication troubleshooting should advance to account and group queries.\n\n## Verification\n\nFrom an approved test configuration, verify name resolution and the server certificate chain with normal validation enabled. Then test a designated directory account and group lookup. Record transport, bind, and authorization results separately, and never include passwords or private keys in the diagnostic evidence.\n\n## Official reference\n\n[Netgate — LDAP Authentication Servers](https://docs.netgate.com/pfsense/en/latest/usermanager/ldap.html). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/match-pfsense-ldap-transport-hostname-and-issuing-ca-together/", "url": "https://update.dsesecurity.com/updates/match-pfsense-ldap-transport-hostname-and-issuing-ca-together/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/match-pfsense-ldap-transport-hostname-and-issuing-ca-together/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Match pfSense LDAP transport, hostname, and issuing CA together", "item": "https://update.dsesecurity.com/updates/match-pfsense-ldap-transport-hostname-and-issuing-ca-together/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/match-pfsense-ldap-transport-hostname-and-issuing-ca-together/#article", "identifier": "https://update.dsesecurity.com/updates/match-pfsense-ldap-transport-hostname-and-issuing-ca-together/", "url": "https://update.dsesecurity.com/updates/match-pfsense-ldap-transport-hostname-and-issuing-ca-together/", "headline": "Match pfSense LDAP transport, hostname, and issuing CA together", "description": "An IP address that reaches LDAP may still fail the certificate identity check.", "abstract": "An IP address that reaches LDAP may still fail the certificate identity check.", "articleBody": "An IP address that reaches LDAP may still fail the certificate identity check.\nSource facts\nNetgate states that the configured LDAP host must match the server certificate when encrypted transport is used. STARTTLS negotiates encryption on its LDAP connection, while SSL/TLS uses the encrypted LDAP mode. The selected Peer Certificate Authority validates the server certificate and must match its issuer; the documentation distinguishes that from an optional client certificate.\nSource: Netgate — LDAP Authentication Servers.\nApplicability\nThis concerns pfSense LDAP authentication-server configuration.\nDSE recommendation\nDSE recommends recording the server’s certificate name, DNS result, transport mode, port, and issuer as one connection profile. Resolve the intended hostname through an approved DNS path instead of disabling certificate checks when connecting by IP fails. Import only the needed trust material and avoid confusing a server-trust CA with a client identity certificate. Diagnose transport validation before changing user search filters or broadening directory permissions. Keep transport, server name, port, and selected CA on one reviewed configuration record. Ask the directory owner to confirm that combination before changing bind or search settings. Use the resulting TLS check to decide whether authentication troubleshooting should advance to account and group queries.\nVerification\nFrom an approved test configuration, verify name resolution and the server certificate chain with normal validation enabled. Then test a designated directory account and group lookup. Record transport, bind, and authorization results separately, and never include passwords or private keys in the diagnostic evidence.\nOfficial reference\nNetgate — LDAP Authentication Servers. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:16:16+00:00", "dateModified": "2026-10-20T18:34:35+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/match-pfsense-ldap-transport-hostname-and-issuing-ca-together/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/match-pfsense-ldap-transport-hostname-and-issuing-ca-together/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Match pfSense LDAP transport, hostname, and issuing CA together" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 247, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Netgate — LDAP Authentication Servers", "url": "https://docs.netgate.com/pfsense/en/latest/usermanager/ldap.html" } } ] } }