LDAPS
acronymnetworkingcryptography
Stands for: LDAP over TLS
LDAP encrypted with TLS.
LDAPS wraps LDAP in TLS so directory queries and bind credentials are not sent in the clear (RFC 4513 covers the security mechanisms), essential wherever passwords cross the wire.
LDAPS is LDAP wrapped in TLS on a dedicated port, the older approach alongside StartTLS which negotiates encryption on the standard port. Both are acceptable; what is not is plain LDAP, which carries bind credentials in the clear.
The migration difficulty is certificate validation rather than encryption. Clients that were configured against a plain-text service often trust nothing, and turning on TLS surfaces every certificate problem at once: an internal authority not in the client trust store, a certificate issued for a hostname nobody uses, or a directory reached by an address rather than a name. Those are all solvable and they are the reason the change takes longer than the configuration flag suggests.
Also known as: ldaps