Port reference
Port 636 (TCP) – LDAPS (LDAP over TLS)
LDAPS — LDAP directory queries wrapped in TLS for confidentiality and integrity.
Quick facts
- Transport
- tcp
- Category
- Well-known
- TLS
- Encrypted
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on domain controllers that have a server certificate installed (often via AD CS). Should be the preferred directory channel over cleartext 389.
What is port 636 used for?
Port 636 is the default port for LDAPS — LDAP directory traffic wrapped in TLS. It carries the same directory lookups and changes as plain LDAP, but encrypted so usernames, passwords, and results are protected in transit. It is most associated with Microsoft Active Directory and with OpenLDAP, and is used by the many applications that authenticate users or look up accounts against a directory.
When would you open it?
You open port 636 if you run a directory server — an Active Directory domain controller or an OpenLDAP server — that other systems query securely. It needs a valid TLS certificate installed. Open it only on directory servers, and only to the applications and networks that need directory access.
Is it safe to open?
It is the secure version of LDAP and safe to use with strong TLS and a valid certificate, but keep it on trusted networks rather than the open internet. See the security notes below.
How to check if this port is open
ss -tulpn | grep :636
nmap -p 636 <target>netstat -ano | findstr :636
Test-NetConnection <host> -Port 636lsof -i :636
nmap -p 636 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 636 to your device's local IP, internal port 636, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 636/tcpsudo firewall-cmd --permanent --add-port=636/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 636 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 636" -Direction Inbound -Protocol TCP -LocalPort 636 -Action AllowSecurity & risks
Common attacks
- Directory enumeration over an authenticated channel
- Weak/expired TLS and certificate validation flaws
- Anonymous or unauthenticated bind (if permitted)
- Credential abuse against directory ACLs
Hardening
- Require LDAPS and disable cleartext LDAP simple binds where feasible
- Use strong TLS (1.2+), valid certificates, and disable legacy ciphers
- Enforce LDAP channel binding and signing
- Disable anonymous binds and apply least-privilege directory ACLs
- Restrict 636 to trusted management networks
How to block this port
sudo ufw deny 636/tcpsudo firewall-cmd --permanent --remove-port=636/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 636 -j DROPNew-NetFirewallRule -DisplayName "Block 636" -Direction Inbound -Protocol TCP -LocalPort 636 -Action Blocknmap snippet
nmap -p636 --script ssl-cert,ssl-enum-ciphers,ldap-rootdse <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is the difference between LDAP (389) and LDAPS (636)?
- LDAP on 389 is cleartext; LDAPS on 636 wraps the same protocol in TLS, encrypting credentials and directory data in transit. LDAPS is the secure choice.
- Does LDAPS prevent LDAP enumeration?
- No. TLS protects confidentiality, but an authenticated (or anonymously bound) attacker can still enumerate the directory. Combine LDAPS with channel binding and ACL hardening.