TCP 636
Synopsis
- TCP port 636 is used by LDAPS (LDAP over SSL/TLS), the encrypted form of LDAP.
- Microsoft Active Directory Domain Services (AD DS) and AD Lightweight Directory Services expose LDAPS on 636 for secure directory binds and queries.
- OpenLDAP commonly listens on 636 for ldaps:// connections.
- Oracle Internet Directory and Oracle Unified Directory use 636 for LDAPS.
- IBM Security Directory Server (Tivoli) and Micro Focus/NetIQ eDirectory provide LDAPS on 636.
- Apache Directory Server and Red Hat Directory Server (389 Directory Server) offer LDAPS on 636.
- Managed offerings like Azure AD Domain Services and Google Cloud Managed Microsoft AD expose LDAPS on 636 (with customer-provided certificates).
- Network/identity platforms such as Cisco ISE, Palo Alto Networks devices, and Fortinet FortiAuthenticator connect to external directories via LDAPS on 636.
- Applications like Zimbra Collaboration Suite and Atlassian Crowd can integrate with AD/OpenLDAP over 636.
- Security note: attackers often scan 636 to brute-force LDAP credentials or abuse misconfigurations (e.g., anonymous/simple binds allowed, weak TLS/certificate validation) to enumerate or exfiltrate directory data.
Observed activity
Last 30 days
Detailed chart