Match pfSense LDAP transport, hostname, and issuing CA together

An IP address that reaches LDAP may still fail the certificate identity check.

Source facts

Netgate states that the configured LDAP host must match the server certificate when encrypted transport is used. STARTTLS negotiates encryption on its LDAP connection, while SSL/TLS uses the encrypted LDAP mode. The selected Peer Certificate Authority validates the server certificate and must match its issuer; the documentation distinguishes that from an optional client certificate.

Source: Netgate — LDAP Authentication Servers.

Applicability

This concerns pfSense LDAP authentication-server configuration.

DSE recommendation

DSE recommends recording the server’s certificate name, DNS result, transport mode, port, and issuer as one connection profile. Resolve the intended hostname through an approved DNS path instead of disabling certificate checks when connecting by IP fails. Import only the needed trust material and avoid confusing a server-trust CA with a client identity certificate. Diagnose transport validation before changing user search filters or broadening directory permissions. Keep transport, server name, port, and selected CA on one reviewed configuration record. Ask the directory owner to confirm that combination before changing bind or search settings. Use the resulting TLS check to decide whether authentication troubleshooting should advance to account and group queries.

Verification

From an approved test configuration, verify name resolution and the server certificate chain with normal validation enabled. Then test a designated directory account and group lookup. Record transport, bind, and authorization results separately, and never include passwords or private keys in the diagnostic evidence.

Official reference

Netgate — LDAP Authentication Servers. Reviewed October 20, 2026.