Why doesn’t ldapsearch over ssl/tls work?

Question

First, replace -h my.server.com -p 3269 with -H ldaps://my.server.com:3269 as suggested by @dearlbry.

Then, in /etc/openldap/ldap.conf (or /etc/ldap/ldap.conf on my Ubuntu 13.04), disable certificate verification by adding this :

HOST my.server.com
PORT 3269
TLS_REQCERT ALLOW

You can also create a ldaprc file in the current directory with the same content if you don’t want to affect the whole system.

This will enable ldapsearch over SSL, but without verification. Follow these steps to add certificate validation(URL updated 2023) to the mix.