Port 636LDAPS
LDAPS, or Lightweight Directory Access Protocol over TLS/SSL, is an encrypted form of LDAP that facilitates secure communication between directory service clients and servers. It operates over standard port 636 and is widely used in enterprise environments for secure directory queries, authentication, and management, ensuring sensitive data remains confidential during transmission..
- transport
- tcp · udp
- in transit
- encrypted
- assignment
- official
- risk
- 5/10
- lookups
- 15,629
2 transports registered
payload protected on the wire
registered with iana
caution
rank 199 of 993 · top 20%
Technical Details
what runs on :636Lightweight Directory Access Protocol over TLS/SSL (LDAPS) is a secure version of LDAP which performs directory service operations over a secure transport layer. LDAP is an application protocol that enables querying and modifying directory services; LDAPS encrypts this communication to safeguard against interception.
By default, LDAPS communicates over TCP port 636, establishing a TLS/SSL connection prior to any LDAP operations. This ensures that credentials and directory data are encrypted during transit, preventing unauthorized inspection or tampering. LDAPS supports mutual authentication if configured, increasing security by confirming the server's identity to clients.
LDAPS is commonly deployed in Microsoft Active Directory environments or other LDAP-based directories to provide encrypted authentication and directory lookups across enterprise networks. It is typically part of corporate security and access control solutions, helping enforce privacy and integrity within directory-based applications.
Security Information
exposure of :636risk score
5/ 10caution
worth attention. how exposed you are depends on configuration — don't leave it reachable from the internet without a reason.
security averages 3.8 across 216 ports — this one sits 1.2 above.
in transit
encrypted
payloads are protected on the wire
assignment
official
registered with iana for this service — scanners fingerprint it by number
reachable over
tcp · udp
udp is connectionless — source addresses are trivially spoofed and it is a reflection favourite
security overview
Common Vulnerabilities:
- Weak SSL/TLS protocols (e.g., SSLv2 or SSLv3) susceptible to downgrade or protocol attacks
- Use of weak or expired certificates allowing Man-in-the-Middle (MitM) attacks
- Misconfigurations exposing internal directory information externally
- Insufficient access controls leading to unauthorized disclosure of directory data
- Exploitation of unpatched LDAP or SSL libraries with known vulnerabilities
Common Mitigations:
- Enforce strong TLS versions (TLS 1.2 or higher) and disable deprecated protocols
- Regularly update and manage certificates, employing CA-signed certificates with proper validation
- Harden access controls and restrict LDAPS connections to trusted sources only
- Employ network segmentation and firewall filtering for port 636
- Regularly patch LDAP server software and underlying SSL/TLS libraries
- Monitor LDAPS traffic for anomalies to detect potential attacks
Related Ports
the 8 most looked-up other ports in security — 216 ports carry that label.
| port | service | risk | |||
|---|---|---|---|---|---|
| :8881 | Atlasz Secure Server | TCP | Web Services | caution | 67.6k |
| :443 | HTTPS | TCPtls | Web Services | caution | 65.9k |
| :8291 | Winbox MikroTik Admin | TCP | Security | caution | 62.9k |
| :3268 | Microsoft Global Catalog (GC) | TCPUDP | Security | caution | 54.6k |
| :135 | Microsoft EPMAP | TCPUDP | Security | caution | 51.9k |
| :3128 | Squid Proxy HTTP | TCP | Web Services | caution | 45.8k |
| :8080 | HTTP Alternate | TCPtls | Web Services | caution | 44.9k |
| :7000 | Vuze HTTPS Tracker | TCPtls | Security | caution | 28.9k |
risk mix of the 8 listed
- caution100%
3 of 8 encrypted