How do I fix LDAPS certificate verification errors from Linux?

LDAPS needs a complete, valid trust chain. Check the certificate served on port 636 with openssl, inspect its issuer and Authority Information Access fields, and obtain the corresponding intermediate and root certificates. Add those CA certificates to the Linux trust store. Renaming a certificate file does not convert its encoding, so make sure it is actually PEM and contains a block beginning with -----BEGIN CERTIFICATE-----.

The certificate installed on the domain controller is the server certificate; the Linux machine must trust the CA that issued it. Confirm the chain independently with something like openssl s_client -connect my.server.dc:636 -showcerts -CAfile your-ca-bundle.pem -verify_return_error. If that succeeds, apply the same CA bundle or trust-store configuration to the ticketing application.

The client probably does not trust the issuing CA yet. Install the internal root CA and any intermediate CA certificates in PEM format, rather than installing only the domain controller’s server certificate. Then run the appropriate trust-store update command again. Also verify that the server certificate includes the exact DNS name you use for the connection.

Some LDAP clients do not automatically use the operating system trust store. For OpenLDAP, configure the CA location in the client configuration, for example TLS_CACERT or TLS_CACERTDIR, using the path where the trusted CA certificates are stored. If using a certificate directory, generate the required hash links with openssl rehash, then test again.