Quiz Entry - updated: 2026.10.22
What is the difference between LDAPS and StartTLS?
LDAPS wraps the whole connection in TLS from the first byte on a separate port (636); StartTLS starts as plain LDAP on port 389 and then upgrades the same connection to TLS with an extended operation, which is the mechanism LDAPv3 actually standardises.
| LDAPS | StartTLS | |
|---|---|---|
| Port | 636 | 389 (same as plain LDAP) |
| When TLS starts | Immediately, before any LDAP message | After the client sends the StartTLS extended request |
| Standard status | Common practice since LDAPv2, never formally standardised | Part of LDAPv3 (RFC 4511, Section 4.14; RFC 4513) |
| URL scheme | ldaps:// |
ldap:// plus the StartTLS request |
Both give the same protection once TLS is up. The practical pitfall with StartTLS is that the client must insist on it: if a client merely tries StartTLS and silently continues in plain text when it fails, an attacker in the middle can strip the upgrade and read a simple-bind password. Whichever variant is used, the client must also verify the server certificate, otherwise TLS does not stop a man-in-the-middle.
Go deeper:
RFC 4511, Section 4.14: StartTLS Operation — the request and response that upgrade a connection to TLS.- LDAP StartTLS (Wikipedia) — notes that LDAP over SSL on port 636 was never formally standardised.
- OpenLDAP Admin Guide: Using TLS — configuring certificates and requiring TLS on a real server.